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BIOMETRIC IDENTIFIERS AND THE MODERN 
FACE OF TERROR: NEW TECHNOLOGIES IN 
THE GLOBAL WAR ON TERRORISM 


WEDNESDAY, NOVEMBER 14, 2001 

Subcommittee on Technology, 

Terrorism and Government Information, 

Committee on the Judiciary, 

Washington, D.C. 

Subcommittee on Technology, Terrorism, and Government Infor- 
mation, of the Committee on the Judiciary, Washington, D.C. 

The Subcommittee met, pursuant to notice, at 10:05 a.m., in 
Room SD-226, Dirksen Senate Office Building, Hon. Dianne Fein- 
stein. Chairman of the Subcommittee, presiding. 

Present: Senators Feinstein, Cantwell, Hatch, Kyi, and DeWine. 

OPENING STATEMENT OF HON. DIANNE FEINSTEIN, A U.S. 

SENATOR FROM THE STATE OF CALIFORNIA 

Chairperson Feinstein. I would like to call the meeting to order 
and welcome the witnesses, as well as the general public, to this 
hearing of the Subcommittee on Technology and Terrorism with re- 
spect to biometrics. That is the subject for this morning’s panel. 

I would like to welcome the distinguished ranking member. Sen- 
ator Kyi from Arizona, with whom I have had the great privilege 
of working now for a number of years. And I might just say that 
we feel very similarly on these issues so I think it makes for a good 
working team. 

After the September 11 attacks many Americans began to won- 
der how the hijackers were able to succeed in their plans. How 
could a large group of coordinated terrorists operate for more than 
a year in the United States without being detected and then get 
on four different airliners in a single morning without being 
stopped? The answer to this question is that we could not identify 
them. We did not know they were here. Only if we can identify ter- 
rorists planning attacks on the United States do we have a chance 
of stopping them. And the biometrics technology, the state-of-the- 
art technology of today, really offers us a very new way to identify 
potential terrorists. 

Now it is true that biometrics would not deter suicide bombers 
who law enforcement and intelligence officials did not know about. 
However, it would make it easier to prevent entry by individuals 
who are known, who are suspected and who might try to hide their 
identity. For example, in the case of at least two of the hijackers, 
authorities had pictures of them as suspects prior to the attack and 
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airport cameras actually photographed them but because these 
cameras did not use facial biometric systems, security was not 
alerted and the hijackers remained free to carry out their bloody 
plans. 

We also know that a number of the hijackers easily secured false 
ID cards, cards that they used to disguise their identities. If we 
had biometric devices in place these attempts may well — we cannot 
say for sure, but had a chance of being stopped. 

Many experts believe that if we had been using biometrics for 
visa applicants and visa-holders and at customs, baggage and pas- 
senger checkpoints at airports, we could have potentially fore- 
stalled the September 11 attack. 

One reason for this hearing is to explore the types of biometrics 
out there and how they can be used by government in conjunction 
with existing infrastructure and databases to prevent such attacks. 
I am concerned about just passing legislation mandating that the 
government use biometric technology because we all know horror 
stories about mandates going awry. 

A month ago this Subcommittee heard from Paul Collier, the ex- 
ecutive director of the Biometrics Foundation, who pointed out that 
the United States has issued 11 million driver’s licenses and 5 mil- 
lion border crossing cards with biometric data but, and I quote, 
“There are no systems in place to read the biometric data and au- 
thenticate the cardholders.” The point is that despite the fact that 
we have these systems, the departments have not put in place the 
readers. Consequently, the systems are wasted. 

So 16 million smartcards have been effectively rendered 
dumbcards by lack of readers. Thus any biometric solution needs 
to be comprehensive and it needs to work. 

Now what is biometrics? Biometric identifiers use unique biologi- 
cal information from people. It is fingerprints, it is facial structure, 
it is hand shape, it is the characteristics in the iris in our eye. 
These characteristics, measured, ensure that the bearer of the card 
is who they say they are. 

So a biometric identifier is something that you are, a password 
or a PIN is something that you know, and a key or smartcard is 
something that you have. Biometric identifiers are the most secure 
and convenient way to authenticate and identify people because 
they cannot be borrowed, stolen, forgotten or forged. 

I myself went to a street in Los Angeles, Alvarado Street, a while 
back and saw people literally by the dozens purchasing fraudulent 
Social Security cards, fraudulent driver’s licenses, fraudulent other 
IDs. I saw where they print them and they did a beautiful fraudu- 
lent copy in less than 20 minutes and for anywhere from $15 to 
$150 a copy. 

Biometrics make authentication relevant and positive. If you 
take a typical driver’s license, which lists a person’s eye color — 
blue, brown, green, maybe hazel, black — hundreds of millions of 
other individuals share that basic eye color. If you compare iris rec- 
ognition technology, which also looks at the colored portion of a 
person’s eye, the iris, this technology can identify around 270 
unique characteristics of a person’s iris and turn these characteris- 
tics into a code unique to that individual. So only one person alive 
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and only one person who had ever lived would have that code and 
that code could easily be put on a driver’s license. 

Many people assume that biometrics is something out of a high- 
tech action movie, a fancy expensive gadget with only few special- 
ized uses. But, in fact, biometrics has begun to catch on, is becom- 
ing more and more widespread and is getting cheaper every day. 
In fact, there are $20 biometric devices you buy today to attach to 
your home computer. 

So generally, biometrics can be used in three possible ways. It 
can be used to screen employees and control access to sensitive 
areas. This obviously prevents terrorists from getting a job as an 
airline or airport employee or posing as one in order to get access 
to implement a hijacking. A recent GAO audit found that inspec- 
tors were able to carry weapons around two airport security check- 
points merely by flashing false credentials. Such technology is al- 
ready being used at places such as San Francisco International, 
Chicago O’Hare and Charlotte Douglas Airport. 

Secondly, biometrics can be used to compare to a biometric data- 
base of criminals or terrorists to try to catch and stop them. So a 
terrorist whose picture or fingerprint is in a law enforcement data- 
base can be stopped before boarding a plane or entering the coun- 
try. 

Now this kind of biometric use is only as good as the database 
it uses. British law enforcement, as well as in Keflavik Airport in 
Iceland, uses this kind of biometric technology and currently the 
FAA is working on a computer-assisted passenger prescreening sys- 
tem, a system designed to use the passenger information system in 
airline databases to determine if an individual poses a security 
risk. So this system would be made infinitely more useful with bio- 
metrics. 

Now I have received a number of phone calls from experts on bio- 
metrics and these experts, including the main biometric industry 
associations and the National Security Agency, have suggested that 
the industry is extremely fragmented, lacks minimal standards, 
and does not work well together, given the hypercompetitiveness of 
the companies. Currently, for example, there are about 140 compa- 
nies trying to sell hundreds of different overlapping biometric de- 
vices of multiple types. These include fingerprints, hands, irises, 
faces, retinas, voice, handwriting, et cetera. 

Now these companies are today aggressively marketing their dif- 
ferent projects and they are criticizing their competitors. There is 
a lot of confusion about how best biometrics can be used in the war 
on terrorism. But experts are afraid that if government does not 
get involved to provide some order and structure, some standards 
if you will, then the market will result in a gradual and uneven 
adoption of biometric identifiers that will continue to leave our 
country vulnerable to terrorist attack. 

There is no doubt in my mind that piecemeal adoption of bio- 
metrics can be a disaster. For example, the United States has 
issued these 16 million smartcards but there are no systems in 
place to read them. 

I am looking, and I have suggested to the ranking member and 
Senator DeWine, who is here today, that we should also explore the 
creation of an unbiased center, a central clearinghouse if you will. 
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that can test, evaluate and set these standards for biometric solu- 
tions. The center would be a federally chartered nonprofit, tax-ex- 
empt corporation charged with mobilizing both government and the 
private sector to achieve today’s most vital national security goal — 
helping to stop terrorism. The center would involve both the gov- 
ernment and the private sector to be able to advise on how to 
choose and deploy biometric solutions that help detect and deter 
terrorists. 

The center would involve the leading private sector biometric in- 
stitutions. These would include the International Biometric Indus- 
try Association, the Biometric Foundation, the Center for Identi- 
fication Technology Research at West Virginia University, the lead- 
ing university biometrics center. The National Security Agency 
would be the initial coordinating agency for this center and could, 
at the president’s discretion, be replaced by the Office of Homeland 
Security. 

In the bill that Senator Kyi and I have been doing that Senators 
Kennedy and Brownback have just accepted into the bioterrorism 
legislation, we mandate that the centralized database — actually it 
is in the immigration bill — the centralized database be under the 
jurisdiction of the director of homeland security, just to avoid some 
of these problems, but the center would work closely with the Bio- 
metric Management Office at the Department of Defense, which 
has been chartered and funded to provide advice about military 
uses of biometrics to all defense agencies. 

Of course there are many precedents for such a federally char- 
tered center. The major one, of course, is the Manhattan Project, 
which enabled the United States to build the atomic bomb. 

So this is an idea because I am getting very concerned about the 
conflicting information we have received. Today we have two gov- 
ernment witnesses that I will introduce directly following my col- 
leagues’ remarks and then a panel of individual companies who are 
cutting edge companies that have come forward with some inter- 
esting biometric technology and they will be speaking about that 
technology and they have demonstrations which you will see scat- 
tered around the room that they will share their technology on. 

Now I would like to recognize the very distinguished ranking 
member of this Committee, Senator Kyi. 

STATEMENT OF HON. JON KYL, A U.S. SENATOR FROM THE 
STATE OF ARIZONA 

Senator Kyl. Thank you very much. Madam Chairman. I think 
the statement that you have just made summarizes my views and 
as a result I am just going to make one quick point and then get 
on with our witnesses. I know both of us have an obligation at noon 
and so the less you hear from me and the more we hear from you, 
the better. 

We have been at this now for over seven years talking about the 
threats to our society, before those threats materialized, talking 
about the use of technology and it is comforting to me now at least 
to see a lot of colleagues and others saying, “You know what? We 
could use technology in this battle against terrorism.” 

So the purpose of this hearing this morning is not only to vali- 
date that point but to answer a couple of very specific questions 
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from experts. How specifically can we use technology, especially 
biometrics, to prevent terrorism, including illegal entry into the 
United States? And what do our governmental agencies need by 
way of legal authority or financial support in order to achieve these 
objectives in a very quick fashion? Those are the two questions I 
have. So to the extent you can get directly to those points in your 
testimony, I would appreciate it very much and I will simply put 
other remarks in the record. Madam Chairman. 

Chairperson Feinstein. Thanks very much. Senator Kyi. Senator 
DeWine, do you have comments you would like to make? 

Senator DeWine. No. I am anxious to get to the hearing and I 
just want to thank you. Madam Chairman, for having the hearing. 

Chairperson Feinstein. Thank you very much. 

Then we will proceed with the first panel. I will just quickly in- 
troduce both witnesses and then they will proceed and hopefully 
limit their comments so that we can ask some questions back and 
forth. 

The first is Michael Kirkpatrick of the FBI. Mr. Kirkpatrick is 
a 23-year FBI veteran, currently serves as assistant director of the 
Criminal Justice Information Services Division of the FBI. This di- 
vision is the largest within the FBI. It was established in 1992 to 
serve as the focal point and central repository for criminal justice 
information services in the agency. 

We also have Mr. Monte Belger with the FAA. He began his FAA 
career 28 years ago as an entry-level security inspector. He now 
serves as the acting deputy administrator of the FAA. He assists 
the administrator in leading a 49,000-person agency responsible for 
the U.S. aviation system. 

Mr. Kirkpatrick, we will begin with you. 

STATEMENT OF MICHAEL KIRKPATRICK, ASSISTANT DIREC- 
TOR, CRIMINAL JUSTICE INFORMATION SERVICES DIVISION, 

FEDERAL BUREAU OF INVESTIGATION 

Mr. Kirkpatrick. Good morning. Madam Chairwoman and mem- 
bers of the Committee, and thank you for the opportunity to appear 
before the Committee. 

At the Criminal Justice Information Services Division of the FBI 
our mission is to reduce criminal activity by maximizing the ability 
to provide timely and relevant criminal justice information 
throughout the criminal justice community and to other appro- 
priate agencies. The Congress and the taxpayers have invested al- 
most $1 billion for the development and implementation of the so- 
phisticated national computer systems housed at our West Virginia 
complex. Among the programs that we operate there of particular 
interest to the Committee this morning is our automated finger- 
print identification program. 

The FBI has served as the nation’s fingerprint repository since 
1924. During the first 75 years of that stewardship this was a man- 
ual, very labor-intensive process taking weeks and oftentimes 
months to process a single fingerprint card. With the full support 
of Congress and recognizing the need to significantly improve this 
critical service, the FBI, with our partners in the criminal justice 
community and with our partners in private industry, primarily 
Lockheed Martin, Planning Research Corporation and Science Ap- 
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plications International Corporation, were able to develop and 
build the Integrated Automated Fingerprint Identification System 
or lAFIS which became operational in July of 1999. The lAFIS pro- 
vides the FBI with the ability to process key biometric fingerprints 
in a totally electronic environment and we do this 24 hours a day, 
seven days a week, 365 days a year. 

Today we have approximately 42,800,000 digitized criminal fin- 
gerprint records in our database, which is by far the world’s largest 
biometric repository of any kind. It is at least four times larger 
than all the fingerprint repositories in Europe combined. 

Using this state-of-the-art technology we are able to process in- 
coming electronic criminal fingerprints within two hours of their 
receipt and within 24 hours for in-coming electronic civil or appli- 
cant fingerprint submissions. 

The lAFIS is a high-volume system with a capacity for growth. 
Last fiscal year we processed over 15 million fingerprint submis- 
sions, which equals about 1.3 million per month. Each day we add 
over 7,800 new criminal entries which are fully electronic-search- 
able to this database. 

In addition to the tenprint capabilities of lAFIS, it also has a sig- 
nificant latent or crime scene fingerprint capability. When a latent 
fingerprint is lifted from a crime scene it can be sent in and 
searched against lAFIS, against the entire 42.8 million fingerprint 
records. Using this technique, cold cases which are decades old are 
being solved today which never were before. Since the inception of 
this capability, the FBI’s laboratory has made over 700 latent iden- 
tifications, which was more than the combined total in the prior 15 
years. 

On October 29 the president signed into law the USA Patriot 
Act. On behalf of the FBI I would personally like to thank you for 
the passage of this most important piece of anti-terrorism legisla- 
tion. Pursuant to Section 405 of this law, the report on the Inte- 
grated Automated Fingerprint Identification System for ports of 
entry and overseas consular posts, I can report to you today that 
the FBI is already working closely with the Department of Justice 
and other federal agencies to prepare the report that was called for 
in the law on the feasibility of using the lAFIS to better identify 
individuals prior to their entry into the United States. 

Since the lAFIS is the world’s largest biometric database with an 
infrastructure which already connects local, state and federal agen- 
cies, it is a tool that could be used to move our country’s security 
perimeter beyond our borders. 

While the FBI believes that the lAFIS is a national asset, its de- 
velopment has also had significant international ramifications. On 
a global front, fingerprints are the most widely held and used 
forms of positive identification. In this regard the FBI has taken 
the lead in an effort to develop international standards for the elec- 
tronic exchange of fingerprints. We frequently meet with our col- 
leagues in the Royal Canadian Mounted Police and United King- 
dom, as well as in Interpol, on this topic. 

Technology for the capture, search, storage and transmission of 
fingerprints is widely available and, as you will hear today, becom- 
ing more economical. Fingerprint databases already exist at the 
federal, state and local levels and all existing criminal history 
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records are based on fingerprints. I invite the members of the Com- 
mittee and their staffs to West Virginia to visit our complex and 
to witness firsthand this investment in state-of-the-art technology. 

Again I thank you for the privilege of addressing this Committee 
and I am available to answer any questions that you may have. 

[The prepared statement of Mr. Kirkpatrick follows:] 

Michael D. Kirkpatrick, Assistant Director in Charge, Federal Bureau of 
Investigation, Criminal Justice Information Services Division 

Good morning Madam Chairwoman and Members of the Committee. I am Michael 
D. Kirkpatrick, Assistant Director in Charge of the FBI’S Criminal Justice Informa- 
tion Services Division, or CJIS, and I Thank you for the opportunity to appear be- 
fore this Committee. 

I have served in the FBI for more than 23 years. In that time, I have served as 
a special agent in our Cleveland and Kansas City field divisions, and in various su- 
pervisory and management capacities in San Antonio, Texas; pocatello, idaho; and 
at FBI headquarters. In 1996, I was appointed as an Assistant Special Agent in 
charge of the New Orleans Field Division, where I oversaw investigations through- 
out the State of Louisiana. In August 1998, I was assigned to CJIS. Since my ar- 
rival in CJIS, I have served as the Chief of the Resources Management Section, and 
as the Deputy Assistant Director of the Policy, Administrative, and Liaison Branch. 
On April 4 of this year, the Attorney General approved my appointment as the As- 
sistant Director in charge of CJIS. 

CJIS was established in february 1992 and is the largest division within the FBI, 
with a current work force of 2,685. The division is located in Clarksburg, West Vir- 
mnia, on a 986 acre campus. Construction of this world class facility started in Octo- 
ber 1991 and was completed in July 1995, and I am proud to say on-time and under 
budget. 

Our mission is to reduce criminal activity by maximizing the ability to provide 
timely and relevant criminal justice information to the criminal justice community 
and other appropriate agencies. The congress and the taxpayers have invested close 
to one billion dollars for the development and implementation of the sophisticated 
national computer systems housed at the West Virginia complex. Among the major 
programs managed and operated out of this division are: (1) the national crime in- 
formation center, and (2) of interest to this committee today — the automated finger- 
print identification program. 

Since 1924, the FBI serves as the national fingerprint repository. For our first 75 
years, the processing of incoming fingerprint cards was largely a manual, labor in- 
tensive process, taking weeks or sometimes months to process a single fingerprint 
card. 

With the full support of congress and recognizing the dire need to significantly 
improve this critical service, the FBI, with our partners in the criminal justice com- 
munity and leaders in private industry, including Lockheed Martin, Planning Re- 
search Corporation (PRC), and Science Applications International Corporation 
(SAIC), was able to develop and build the integrated Automated Fingerprint Identi- 
fication System, or lAFIS. lAFIS became operational on July 28, 1999, and provides 
the FBI with a totally electronic environment in which to process fingerprint sub- 
missions 24/7/365. Today over 42.8 million digitized criminal fingerprint records re- 
side in the LAFIS database, which is by far the world’s largest biometric repository 
of any kind. It is at least four times larger than all of the fingerprint repositories 
in europe combined. 

Using state-of-the art technology, the lAFIS receives, searches, and stores incom- 
ing fingerprint submissions, and generates responses within two hours of receipt for 
electronic criminal fingerprint submissions and within 24 hours for electronic civil 
submissions. lAFIS is a high volume system with a capacity for growth. In fiscal 
year 2001, our fingerprint receipts totaled 15,451,543 (7,991,125 criminal and 
7,460,418 civil), which equates to 1.3 million receipts per month. Our FY 2001 re- 
ceipts mark a six percent increase over those for the previous fiscal year. In addi- 
tion, each day on average we add 7,863 new searchable criminal entries to this data- 
base. 

At this point, I have only spoken about lAFIS’s ten-print capabilities. This system 
can also process latent fingerprints collected as evidence of a crime. When a latent 
print is lifted from a crime scene, a latent fingerprint examiner can initiate a search 
of the entire LAFIS database to determine the suspect’s identity. This technique has 
permitted the identification of criminal perpetrators from latent prints submitted 
from previously unsolved, “cold” cases. Since the inception of this latent search tech- 
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nique, the FBI’s laboratory division has made 700 latent identifications using lAFIS 
technology. These 700 identifications are more than three times the total number 
of latent identifications made in the 15 years prior to lAFIS. These crimes would 
have otherwise been unsolved. This capability has had a tremendous impact on our 
public safety. 

In response to the September 11 terrorists attacks, CJIS mobilized, along with the 
latent print units of the FBI’s Laboratory Division, to provide disaster relief. This 
assistance included our “flyaway” interim distributed image system, or idis, termi- 
nals and remote latent fingerprint terminals. These computer systems allow dis- 
aster relief teams to submit both ten-print and latent fingerprints electronically to 
the lAFIS from remote locations. IDIS systems have also been deployed in other re- 
cent events, such as the summit of the Americas in Quebec. 

Seven IDIS terminals, three latent work stations, and 32 CJIS employees were 
deployed to New York City; Dover, Delaware; and Shanksville, Pennsylvania, to As- 
sist with Victim Identification. The New York disaster relief team reported 22 suc- 
cessful identifications, four using IDIS technology, and two using remote latent fin- 
gerprint technology. The Pennsylvania disaster relief team made one latent finger- 
print identification. 

On October 29, 2001, the president signed public law 107-56, the usa patriot act 
of 2001. On behalf of the FBI, I personally want to thank you for passage of this 
most important piece of anti-terrorism legislation. I can report that, pursuant to sec- 
tion 405 of this law, report on the integrated automated fingerprint identification 
system for ports of entry and overseas consular posts, the FBI is working closely 
with the department of justice and other federal agencies to prepare this report on 
the feasibility of using the lAFIS to better identify individuals prior to their entry 
into the united states. Since the lAFIS is the world’s largest biometric database, 
with an infrastructure already connecting local, state, and federal agencies, it is a 
tool that could be used to move our country’s security perimeter beyond our borders. 

While the FBI believes that the lAFIS is a national asset, its development has 
had significant international ramifications. On a global front, fingerprints are the 
most widely held and used form of positive identification. In this regard, the FBI 
took the lead in an effort to develop an international standard for the electronic ex- 
change of fingerprints. We frequently meet with our counterparts in the royal Cana- 
dian mounted police and the united kingdom, as well as many representatives from 
interpol, on this topic. I am proud to say that international standards for the ex- 
change and transmission of fingerprints, developed by the FBI, have been accepted 
by all member countries of interpol. We continue to have regular dialogue with our 
international partners in the rcmp, uk, and interpol on matters of mutual interest. 

Technology for the capture, search, storage, and transmission of fingerprints is 
widely available and becoming more economical every day. Fingerprint databases al- 
ready exist at the local, state, and federal levels, and all existing criminal history 
records are based on fingerprints. As I just stated, international standards have 
been accepted by all interpol member countries. These existing biometric systems 
form the foundation for coordinated domestic and international efforts and present 
opportunities to share information that can improve our national security and com- 
bat terrorism and trans-national crime. 

I invite the members of this committee to visit the CJIS complex in Clarksburg 
and witness first-hand this investment in state-of-the-art technology. In closing, I 
again thank you for the privilege of addressing this committee. I am available to 
answer any questions the committee may have. 

Chairperson Feinstein. Thanks very much, Mr. Kirkpatrick. 

The Ranking Member of the Full Committee has come, Senator 
Hatch, and I would like to recognize him and ask him if he has a 
statement he would like to make. 

STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM 
THE STATE OF UTAH 

Senator Hatch. Thank you so much. Madam Chairman. I cer- 
tainly appreciate it. I want to thank you and Senator Kyi person- 
ally for holding this important hearing and I also want to thank 
each of you for your steadfast resolve in helping to lead our na- 
tion’s fight against terrorism. 

Just recently your bipartisan support proved invaluable to our ef- 
forts to enact the USA Patriot Act of 2001, which provided much- 
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needed anti-terrorism tools to our law enforcement and intelligence 
communities. While the USA Patriot Act is a critical first step, 
more can and must he done to protect our nation from terrorists. 

In particular, we need to tighten our border security, including 
our overseas embassies and consulates that function as our ex- 
tended borders against terrorists. The Visa Entry Reform Act of 
2001, recently introduced by the chairwoman. Senator Kyi and my- 
self and others, will, by embracing new pioneering technologies, en- 
hance our ability to prevent terrorists from ever setting foot in this 
country. As a proud cosponsor of this legislation I will help to see 
to it that it is passed into law. 

The key to the legislation is its commitment to the use of biomet- 
ric technology. Biometrics, the science of using physical characteris- 
tics to identify an individual, has long held promise in the areas 
of law enforcement and immigration. While individuals may be 
able to disguise their appearance sufficiently to fool the human eye, 
the technology we will hear described today can thwart the most 
sophisticated criminal mind. 

One use for these technologies is in the immigration area where, 
by using biometric identifiers, we can conclusively confirm the 
identity of those seeking entry into the United States. Imperson- 
ation would be dramatically curtailed, if not eliminated all to- 
gether. And in conjunction with law enforcement and intelligence 
databases, these technologies will enable us to identify potential 
terrorists before they are among us. 

We had just yesterday a group call us claiming that they have 
a very low-cost iris identification system that may be very bene- 
ficial in these areas. We will be interested in following up on that, 
as we will with what every witness here is testifying to today, or 
at least the witnesses’ testimony that we will receive today. 

So I want to thank all of you witnesses who have agreed to come 
here to enlighten us and help us to know better what we should 
be doing in these areas and, above all, I want to compliment our 
chairwoman and ranking member for the leadership that they have 
provided against terrorism. And having lived through putting to- 
gether the final anti-terrorism package that we have passed, an 
awful lot of that bill has been the work of this Subcommittee and 
the work of these two bipartisan senators who have worked so well 
together. 

So I wanted to just personally come and congratulate them, 
thank them for the leadership they are providing, and tell them I 
am going to work very closely with them to make sure that what 
they do comes to fruition. And I want to thank each of you for help- 
ing us to do so. Thank you. Madam Chairwoman. 

[The prepared statement of Senator Hatch follows.] 

Statement of Hon. Orrin G. Hatch, a U.S. Senator from the State of Utah 

Madame Chairwoman, I want to thank you and Senator Kyi for holding this im- 
portant hearing. I also want to thank the two of you for your steadfast resolve in 
helping lead our nation’s fight against terrorism. Just recently, your bipartisan sup- 
port proved invaluable to our efforts to enact the USA PATRIOT Act of 2001, which 
provided much-need antiterrorism tools to our law enforcement and intelligence 
communities. 

While the USA PATRIOT Act is a critical first step, more can — and must — be 
done to protect our Nation from terrorists. In particular, we need to tighten our bor- 
der security, including our overseas embassies and consulates that function as our 
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extended borders, against terrorists. The “Visa Entry Reform Act of 2001,” recently 
introduced by the Chairwoman, Senator Kyi, myself and others, will, by embracing 
new pioneering new technologies, enhance our ability to prevent terrorists from ever 
setting foot in this country. As a proud cosponsor of this legislation, I will help see 
to it that it is passed into law. 

The key to the legislation is its commitment to the use of biometric technology. 
Biometrics, the science of using physical characteristics to identify an individual, 
has long held promise in the areas of law enforcement and immigration. While indi- 
viduals may be able to disguise their appearance sufficiently to fool the human eye, 
the technology we will hear described today can thwart the most sophisticated 
criminal mind. 

One use for these technologies is in the immigration area, where by using biomet- 
ric identifiers, we can conclusively confirm the identity of those seeking entry into 
the United States. Impersonation would be dramatically curtailed, if not eliminated 
altogether. And in conjunction with law enforcement and intelligence databases, 
these technologies will enable us to identify potential terrorists before they are 
among us. 

Chairperson Feinstein. Thanks very much, Senator Hatch. Your 
comments are very much appreciated. Thank you. 

Now we will turn to Mr. Belger of the FAA. 

STATEMENT OF MONTE BELGER, ACTING DEPUTY 
ADMINISTRATOR, FEDERAL AVIATION ADMINISTRATION 

Mr. Belger. Thank you. Madam Chairwoman, Senator Kyi, Sen- 
ator Hatch and members of the Committee. I appreciate the oppor- 
tunity this morning to represent the Federal Aviation Administra- 
tion and talk briefly about the availability of modern security 
equipment and the development of future technologies, such as bio- 
metrics, for use at our nation’s airports. 

With the support of the Congress we have invested at the FAA 
over $440 million, every dollar that the Congress has provided over 
the past five years, to purchase and deploy explosive detection sys- 
tems, explosive trace detection systems, threat image projection x- 
ray machines, and other technology. And in fiscal year 1902, this 
current fiscal year, we plan to spend an additional $293 million, 
the full production level, for explosive detection systems should we 
receive the president’s funding request. 

We are aggressively pursuing new technologies that can be de- 
ployed quicMy. For example, in the area of explosive detection sys- 
tems we have three vendors at our technical center who are devel- 
oping a smaller version of explosive detection systems and we are 
working with them to develop and certify these systems as quickly 
as possible. 

In response to one of the recommendations made by one of the 
two rapid response teams that were convened by Secretary Mineta, 
we have been working with both government and private sector 
technical experts to identify security technologies that are ready for 
deployment now, as well as those technologies that merit acceler- 
ated development. 

As you suggested. Madam Chairwoman, we are getting involved 
and we are trying to bring some structure to these issues, at least 
as they pertain to application at airports, and I just want to men- 
tion three things that we have done in the past several weeks. 

On October 25 we convened a subgroup of one of our security re- 
search and advisory Committees to evaluate the concepts in over 
1,200 recommendations that have been made to the FAA. We have 
asked this group, which is both FAA and industry folks, for a re- 
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port of initial short-term recommendations by the end of this 
month and we have also asked that the advisory Committee pro- 
vide a report to us to identify promising longer-term technologies. 

Secondly, we are sponsoring what is now the third international 
aviation security technology symposium in Atlantic City later this 
month. This symposium will be important in helping to identify 
those technologies that can help meet the challenges we face. Right 
now we have over 40 vendors who will be present at this sympo- 
sium later this month. 

And thirdly, directly related to the biometrics issue for today, we 
have already formed an aviation security biometrics working group. 
This group is chaired by the FAA and the National Institute of Jus- 
tice and we have brought together Federal agencies, both industry 
groups and law enforcement groups to develop a comprehensive 
concept of operations and application of some of these biometric 
systems in the aviation system and at our airports. 

This group is particularly focusing on areas which biometrics can 
be used to improve aviation security and I think. Madam Chair- 
woman, the three issues I am going to mention are identical to the 
three that you mentioned that our group is focussing on. Those are 
employee identity verification protection of public areas through 
surveillance capabilities and passenger identity verification. 

Biometrics that can be applied for purposes of passenger and em- 
ployee identification include iris, hand geometry, fingerprint, voice, 
and facial recognition. And facial recognition also has the potential 
to be used for surveillance in public areas of airports. 

Even before the September 11 attacks, some airports, a small 
number, but some airports, had started to test biometrics and inte- 
grate these systems into their security programs. For example, as 
you mentioned, San Francisco has been using hand geometry sys- 
tems to control access to secured areas actually since 1992. Chicago 
O’Hare installed a pilot system for using fingerprint biometrics for 
increasing both the speed and the security checks for cargo truck 
deliveries at the airport. And Charlotte International Airport, in co- 
operation with U.S. Airways, tested a program in which iris rec- 
ognition technology was used to verify employee identification be- 
fore permitting access to secure areas. 

The bottom line from the FAA is that biometric technology has 
the potential to improve aviation security and these systems are el- 
igible for funding under the airport improvement program. 

As we move ahead, I think we should keep in mind that there 
probably is no one solution, that probably technology by itself will 
not be the solution to the issues that we are facing, but these tech- 
nologies hold great promise. As you also mentioned there are some 
significant challenges and in the world of aviation security we are 
anxious and willing and want to get involved to address these chal- 
lenges and make these systems become operational at our nation’s 
airports. 

Our fundamental goal is 100 percent screening of all passengers, 
baggage, airport and airline personnel, and we believe that these 
systems have a role in the future. 

So that concludes my remarks and I will be glad to answer any 
questions. 

[The prepared statement of Mr. Belger follows:] 



12 


Statement of Monte R. Belger, Acting Deputy Administrator of the Federal 
Aviation Administration 

Chair Feinstein, Senator Kyi, Members of the Subcommittee: 

I am pleased to appear before you today to discuss the availability of security re- 
lated equipment and the status of the development of future technologies, in par- 
ticular biometrics. In the aftermath of the tragedy that occurred on September 11, 
the Federal Aviation Administration (FAA), like the rest of the government, is re- 
thinking our approach to security. The assumptions and strategies that were the 
basis of aviation security a few short weeks ago are being reassessed. No matter 
what overall direction and strategies we finally adopt, I want to assure you that the 
employees of the FAA continue to work tirelessly to identify and implement needed 
changes. 

At the outset, I would like to discuss our most recent initiatives to ensure that 
all viable security technologies including biometrics, are being adequately consid- 
ered, and that there is a plan in place to quickly take advantage of those promising 
technologies that can assist us in our fight against terrorism. In response to one of 
the recommendations made by the rapid response teams convened by Secretary Mi- 
neta in the aftermath of September 11, the FAA was tasked with working with both 
government and private sector technical experts to identify beneficial security tech- 
nologies that are ready for deployment, as well as those technologies that merit ac- 
celerated development. We will identify technologies that we can deploy, both short 
term and long term, which can significantly augment the screening of passengers, 
checked luggage, cargo, and airport and airline employees. 

The FAA’s efforts to increase airport security since September 11 include the for- 
mation of the Aviation Security Biometrics Working Group. This working group, 
chaired by FAA and the Department of Justice’s National Institute of Justice, has 
brought together representatives of Federal agencies, industry and law enforcement 
to develop a comprehensive concept of operations for the application of biometrics 
in aviation security. 

The biometrics working group has identified four areas in which biometrics can 
be used to improve aviation security: (1) employee identity verification and access 
authorization to secured areas within an airport; (2) protection of public areas in 
and around airports through surveillance to prevent harm to airports and aircraft; 
(3) passenger protection and identity verification which would involve enrolling pas- 
sengers in a national identification system, and likely to have multiple biometrics; 
and (4) aircrew identity verification both on the ground and en-route. Biometrics 
that can be applied for the purpose of passenger, employee and aircrew identifica- 
tion include iris, hand geometry, fingerprint, voice and facial recognition. Facial rec- 
ognition has potential to enhance aviation security through surveillance, as the 
technology matures. 

Prior to the September 11th attacks, airports had started to test the utility of bio- 
metrics for improving airport security, and integrating biometric systems into their 
security programs. For example, San Francisco International Airport has been using 
hand geometry systems to control access to secure areas since 1992. Chicago’s 
O’Hare airport installed a pilot system using fingerprint biometrics for increasing 
speed and security for cargo truck deliveries at the airport. Also, Charlotte/Douglas 
International Airport, in cooperation with US Airways, conducted a pilot program 
in which iris recognition technology was used to verify employee identification be- 
fore allowing access to secure areas. Additionally, the Immigration and Naturaliza- 
tion Service uses the INS Passenger Accelerated Service System (INSPASS), a hand 
geometry technology, at nine international airports to expedite frequent travelers’ 
processing into the United States. 

Biometric technology has the potential to greatly improve aviation security and 
is one of the most commonly recommended technologies for doing so. Although there 
are still questions regarding this promising technology and its effects on the privacy 
and civil rights of the American people, resolving these issues remains a priority 
for both Secretary Mineta and the Administrator. Of course, the new security meas- 
ures have been and would continue to be implemented in a manner consistent with 
our commitment to protecting passenger and employee civil rights. 

In addition to the biometrics working group initiative, on October 25, the FAA 
convened its security research and advisory committee, chaired by John 
Klinkenberg, Vice-President for Security for Northwest Airlines, to work toward 
achieving our security goals. This Committee will evaluate over 1,000 recommenda- 
tions made to the FAA by various industry sources. The Administrator asked that 
the Committee provide her with a report on its initial recommendations by the end 
of November. The Administrator expects the report to identify the most promising 
technologies for providing early security benefits to the flying public, as well as their 
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suggested implementation strategies. Likewise, the report will identify promising 
longer term technologies that are worthy of accelerated development. 

The FAA is also sponsoring its third International Aviation Security Technology 
Symposium in Atlantic City, New Jersey from November 27 through November 30. 
This symposium will feature numerous sessions on diverse security topics including 
human factors, deployment of new explosives detection equipment, emerging tech- 
nologies, aircraft hardening initiatives, cargo screening, and integrated security sys- 
tems. Attendees will have the opportunity to view, first hand, vendors’ security tech- 
nologies. The symposium, which is also sponsored by the National Safe Skies Alli- 
ance, Airports Council International, Air Transport Association, and the American 
Association of Airport Executives, was planned before the terrorist attacks, but it 
is now that much more critical for identif 3 dng those technologies that can help meet 
the challenges we face in this new era of heightened aviation security. 

Now that I have provided an overview of some of our most recent security initia- 
tives, I would also like to provide a broader overview of our efforts to enhance secu- 
rity through technology. The goal of aviation security is to prevent harm to pas- 
sengers, crew and aircraft, as well as to support national security and counter-ter- 
rorism policy. How we achieve that goal now requires that we take a comprehensive 
look at how airport screening is undertaken from workforce, technology, and proce- 
dural standpoints. The Administration is looking at all options and has not ruled 
out any alternative at this time. 

Four years ago, the White House Commission on Aviation Safety and Security 
(the Commission) issued 57 recommendations, the majority of which focused on im- 
proving aviation security. Most importantly, the Commission acknowledged that 
aviation security was a national issue that required a national focus and reliable 
funding. In the area of security technology, it was recommended that FAA deploy 
existing security technologies, establish standards for developing technologies, and 
work with other government agencies and industry to develop new technologies. 
Thanks to Congressional support of these recommendations, the FAA has spent 
$445 million in the past 5 years to purchase explosives detection systems (EDS), ex- 
plosives trace detection (ETD) devices and threat image projection (TIP) ready x-ray 
machines. In fiscal year 2002, we plan to spend an additional $293 million, the full 
production level for EDS equipment, should we receive the President’s funding re- 
quests. 

One hundred fifty-nine EDS machines have been installed at airports across the 
country and we are working to deploy over 20 more in the coming months. In addi- 
tion, we need to work with the companies that manufacture the systems to see how 
quickly they can produce more systems for continued deployment. Products of two 
EDS vendors have been certified and variations of these products are currently 
going through the certification process. Prior to September 11, EDS was primarily 
used to screen checked bags belonging to persons identified by the Computer As- 
sisted Passenger Prescreening System (CAPPS). CAPPS allows the air carrier to 
focus EDS screening on a manageable number of passengers, for example, those 
whom we cannot discount as potential threats to civil aviation, based on parameters 
developed within the counter-terrorism community and reviewed by the Department 
of Justice to ensure that the methods of passenger selection do not result in illegal 
discrimination. CAPPS also selects passenger bags on a random basis for additional 
screening. In the aftermath of September 11, FAA has committed to increasing the 
number of passenger bags that are randomly screened. Furthermore, EDS machines 
are now running continuously at those airports to which they have been deployed, 
CAPPS has been adjusted and passengers and their carry-on items are being 
screened on a continuous basis at the boarding gate. 

In addition to EDS, FAA is currently purchasing ETD devices from the three ven- 
dors with FAA approved products. These devices can detect the presence of explo- 
sive materials in a passenger’s checked or carry-on bags. As of last Friday, we had 
installed 884 ETD devices in 177 airports across the country. 

Another tool available to test and measure screener proficiency is software tech- 
nology, known as the Threat Image Projection (TIP) system, installed on conven- 
tional x-ray machines. TIP electronically inserts images of possible threats (e.g., a 
gun, a knife, or an explosive device) on a x-ray monitor. The monitors show the 
image as if it were within a bag being screened. Its purpose is to provide training, 
keep screeners alert, and measure screener performance. High scores detecting TIP 
images equate to a high probability of detecting actual bombs and dangerous weap- 
ons. Not only can TIP data be potentially used to assess screener performance over 
time, but the results can also be used to analyze any correlation between perform- 
ance and experience. New images will be added to the FAA-approved TIP library 
being installed on the x-ray machines at the security checkpoints to improve screen- 
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er vigilance and training. To date, 741 of these units have been deployed to 75 U.S. 
airports for checkpoint screening. 

Aside from those technologies approved by the FAA, there are a variety of tech- 
nologies in various stages of development. As is the case with other areas in which 
the FAA has regulatory oversight, FAA sets a security standard airlines and air- 
ports must meet. It is routine in the airline industry for individual carriers or air- 
ports to exceed FAA standards in certain areas and I think we need to look at how 
that approach might be incorporated with respect to aviation security. 

Although, FAA does not currently require airports or airlines to have EDS, if they 
do have the equipment, we require them to use it. We will continue to work aggres- 
sively so that every screening checkpoint gets the equipment it needs to ensure a 
more effective aviation security system 

We also need to determine whether other security technologies currently in devel- 
opment can be effectively used by airlines and airports. For example, there are a 
number of backscatter technologies, chem/bio trace detection, and portal screening 
technologies that are in different stages of development. As I mentioned earlier, bio- 
metrics (e.g., iris and finger print identification) are currently being tested in the 
operational environment. The Rapid Response Team on Airport Security also rec- 
ommended that we should move to a greater use of positive identification tech- 
nologies. We are considering this recommendation and we are working with indus- 
try to see whether and how all of these efforts can be incorporated into airline and 
airport operations to improve aviation security, while upholding America’s steadfast 
commitment to the protection of civil rights. To this end, we have met and will con- 
tinue to meet with civil rights groups to discuss how we can ensure continued pro- 
tection of Americans’ civil rights as we incorporate enhanced security measures, in- 
cluding some of the new technologies. 

Just to make sure that we are not missing anything that is out there, FAA issued 
an announcement that appears on our web site (www.faa.gov) requesting informa- 
tion about any product or technology that could be helpful in improving aviation se- 
curity. As you can imagine, this requires sorting through a great deal of informa- 
tion. So, while there does not appear to be a single technology that addresses all 
of our security concerns, we are committed to working through the various options 
available to us. 

The Secretary of Transportation, the FAA Administrator and the entire Adminis- 
tration are doing everything in our power to bring the nation’s air transportation 
system back into full operation with the highest levels of safety possible. Recently, 
Secretary Mineta directed FAA special agents to crack down on airport and air car- 
rier security deficiencies by taking decisive steps, including clearing concourses, re- 
screening passengers, and even holding flights where appropriate. This action re- 
flects both the Department’s and the FAA’s unyielding commitment to civil aviation 
security and the restoration of public confidence in the nation’s air transportation 
system. It is clear that through constant vigilance, the application of new tech- 
nologies and procedures, and assistance from its national and international part- 
ners, the FAA will succeed in its civil aviation security mission. 

Because civil aviation exists in a dynamic environment, the FAA must develop a 
security system that optimizes the strengths of a number of different technologies. 
This system must be responsive to potential means of attack and must be able to 
anticipate future risk to the civil aviation environment. In a democracy, there is al- 
ways a need to balance freedom and security. Our transportation systems, reflecting 
the value of our society, have always operated in an open and accessible manner, 
and we are working hard to ensure that they will do so again. 

This concludes my prepared remarks. I would be happy to answer any questions 
you may have. 

Chairperson Feinstein. Thank you very much. We appreciate 
your comments. 

I will ask two quick questions, the first one to Mr. Kirkpatrick. 
In your view, which biometric would be the most effective against 
terrorists? And if you should indicate fingerprints, what do you say 
about the fact that we do not have fingerprints for many of our ter- 
rorists in the database and part of that question is were the finger- 
prints of any of the September 11 hijackers in an FBI database? 

Mr. Kirkpatrick. Madam Chairwoman, I think that as Mr. 
Belger said, there is no single biometric application that is going 
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to be the be-all-and-end-all. I think you have to look at the use that 
it would be put to. 

Fingerprints would play a very important part in positively iden- 
tifying someone and, along with a digital photograph or other bio- 
metric, enrolling them in a system and then possibly some other 
type of biometric hand geometry, iris recognition could be used to 
control access in and out of areas. 

To my knowledge, there were none of the September 11 terrorists 
who were in the FBI fingerprint database, no. 

Chairperson Feinstein. Thank you very much. 

And one for Mr. Belger. Can you tell me how many airports are 
submitting the fingerprints of their new employees for a criminal 
fingerprint check? 

Mr. Belger. Yes. Today and since December of last year the 21 
airports, what we call the category X airports in this country, 
under legislation that was passed last year have been submitting 
fingerprint checks for all new employees who are working as pas- 
senger screeners or who are working in secured areas of the air- 
port. We would like to extend that to all airports and we would like 
to extend it to all employees, not just those that are being hired 
now but all current employees. As the administrator said a couple 
of weeks ago, we are working on a rule to do that and I hope to 
be able to have that on the street very soon. 

Chairperson Feinstein. I think that is extraordinarily important 
in terms of saying to people that our airports are secure. How soon 
do you estimate that will be? 

Mr. Belger. We are talking days. 

Chairperson Feinstein. Days. And that will be for everybody — 

Mr. Belger. Yes, we would include — 

Chairperson Feinstein. — who works at an airport. It will go 
back even if — not just new employees. 

Mr. Belger. That is correct. We would like to ensure that every 
employee at every airport who is working as a screener or is in- 
volved in that process or who has access to the very sensitive and 
secured areas of the airport has gone through a criminal history 
records check, which requires a fingerprint. 

Chairperson Feinstein. Right. And can you tell us what biomet- 
ric technologies the FAA is currently using? 

Mr. Belger. Well, the three airports I mentioned are using dif- 
ferent systems. We are currently testing and evaluating the whole 
range of capabilities and we are trying, as you suggested, to bring 
some order in the form of a concept of operations of how these sys- 
tems can most effectively be used at airports and that is where we 
are focusing right now. There is very little use today at our nation’s 
airports of these biometric systems. We are trying as best we can, 
within the aviation world at least, to establish some operational 
concepts and some standards so that we can help our airports pick 
the right ones to use. 

Chairperson Feinstein. I have to ask one more quickly. Do you 
feel you are equipped to set the standards? I do not mean that in 
a derogatory sense. I mean there is just so much competition out 
there; it is very difficult. 

Mr. Belger. It is. I talked to one of the gentlemen this morning 
who is working on this full-time at our technical center up in At- 
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lantic City and he expressed that same thought. We are doing the 
best we can. I think we would be delighted to work with an organi- 
zation, as you suggested, that would be charged with setting some 
national standards. We would be delighted to do that. 

Chairperson Feinstein. Thank you very much. 

Senator Kyi? 

Senator Kyl. Thank you. 

First Mr. Belger. You indicate that you are working hard to I 
prove the passenger manifest system, would like to make it manda- 
tory, and that all airlines would be required to participate, and also 
to expand that to other types of travel — cruise lines and cross-bor- 
der bus lines, and the like. 

Is there any way that we can require all passenger manifest in- 
formation prior to departure and boarding, rather than prior to ar- 
rival? And would it not make sense in trying to prevent terrorism 
to prevent the terrorists from actually boarding the actual mode of 
transportation? How could that all be done? 

Mr. Belger. If I could answer that perhaps in two ways, one, for 
passengers who are departing from the United States, we do have 
a system in the FAA or with the carriers where we do apply a 
preboard screening profiling system which is rather effective. 

In terms of arriving passengers into the U.S., which I think was 
the first part of your question, that is really an INS and a Customs 
responsibility more so than the FAA’s but your suggestion that it 
would be a good idea to know who is on that airplane before they 
get here is certainly a good one. 

Senator Kyl. It is my understanding that the fingerprint check 
for employees will soon be required for everyone having access to 
secured areas in airports. That includes people like food service 
people and the like, does it? 

Mr. Belger. Yes, sir. It would be anybody who has access to 
those areas. 

Senator Kyl. Now that system is only as good as the continued 
check of the identification of people who are coming in and we have 
evidence that there was on the person of some of the people that 
are being investigated in connection with the September 11 events 
forged documents for different airline personnel positions, some of 
which presumably would permit them entry into a secure area. You 
may determine that John Doe has no criminal background and 
therefore could be hired to work at the airport but if someone 
steals John Doe’s identification or it is not a tamper-proof kind of 
identification, what is to prevent somebody from gaining unauthor- 
ized access today to a secure area? 

Mr. Belger. Those are vulnerabilities and we do require the air- 
ports who issue these identification cards to periodically inventory 
and check to make sure that the cards they have issued are, in 
fact, in the possession of the person they issued them to. So we do 
require them to periodically check their database and check the 
cards that they have issued to make sure that they are still in the 
hands of — 

Senator Kyl. But there is not any biometric identifier required 
today. 

Mr. Belger. That is correct. 

Senator Kyl. There is none today. 
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Mr. Belger. That is correct. 

Senator Kyl. Would that not he a necessity, to have security? 

Mr. Belger. It would certainly help. No doubt about it; it would 
help to ensure that the person is the person who applied for and 
received that card. We are encouraging airports to go ahead and 
start using these systems. There is really nothing today that pre- 
vents an airport from — 

Senator Kyl. Well, I think leadership has to come from the top 
and it has to be — this is a matter of national security now. I do not 
think it is sufficient to simply say we have encouraged airports to 
figure out how to ensure the security of their own perimeters and 
of their own personnel. 

We believe, I think, that there has to be a national standard ap- 
plicable to all of the major airports and we believe that biometric 
technology is a way to ensure that the people who show up for 
work can be identified as the appropriate people. Should it not be 
FAA policy to develop that national system and try to put it into 
place as soon as possible? 

Mr. Belger. I believe it is and we are starting to do that. We 
are trying to do that. To the extent that there are other folks who 
are working on national standards, we would love to be a part of 
that. 

Senator Kyl. I think we will be sure you are part of it. One of 
the things that Senator Feinstein pointed out and she actually 
demonstrated this to the audience at the last hearing we had is 
that many federal documents like pilot licenses are not fraud-proof. 
They are, she pointed out, just a little cardboard with a perforated 
edge that you kind of tear out of a sheet and obviously there are 
other documents that permit a pilot to gain entry to secure areas 
but those are the kinds of documents that should have a biometric 
identifier, are they not, in your opinion? 

Mr. Belger. I think they should in the future, yes, sir. 

Senator Kyl. Mr. Kirkpatrick, do you agree with that? 

Mr. Kirkpatrick. Yes, sir. I would just add that I think that a 
criminal history check based upon fingerprints could serve as a 
strong foundation upon which the biometrically based access sys- 
tems that you are referring to could be added on top of 

Senator Kyl. Right. One of the things that — this will be my last 
question and it is directed to you. In response to Senator Fein- 
stein’s first question relating to the terrorists and not having fin- 
gerprints on them, and so on, you said basically all of these tools 
are useful in different ways for different functions. We all under- 
stand the need for a national fingerprint database to catch crimi- 
nals here in it U.S. and identify people and the like, but it may 
not be the most useful with respect to preventing terrorists from 
other countries coming into our country. 

What we need from you is testimony today and recommendations 
later about how to integrate those systems and how to prevent hav- 
ing too many duplicative systems to try to reduce the cost so that 
we have one way of looking at things hopefully over time. Any par- 
ticular thought on that? 

Mr. Kirkpatrick. Well, my thought on that, sir, would be that 
we need to build upon the infrastructure that is already in place 
and have a greater integration of information that exists in various 
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different agencies’ stovepipe-type systems today. I think that the 
attorney general and the director have hoth spoken very vocally 
about the need to share information better and I think that that 
would certainly fall underneath that. 

Senator Kyl. Thank you. 

Chairperson Feinstein. Senator DeWine? 

Senator DeWine. Madam Chairman, thank you very much. 

Mr. Kirkpatrick, thank you for your testimony. You reference 
Section 405 of the Patriot Act, which is a provision that I wrote 
that you are now beginning to implement. I am glad to see that you 
are moving forward. 

I wonder if you could give us some idea about what the FBI’s 
concept is for applying this lAFIS system to the embassies. I am 
sure you have some idea. We are not asking for your report yet but 
maybe a little preview of what is possible there. 

Mr. Kirkpatrick. Yes, sir. And this is very preliminary in terms 
of — 

Senator DeWine. We will take it that way. 

Mr. Kirkpatrick. — the concept. 

We believe that livescan fingerprint devices could be deployed 
out at the embassies and consulates to take 10 fingerprints and 
also capture a digital photograph of individuals who are applying 
for visas in their home countries. Those could then be transmitted 
to the FBI for a criminal check but in addition to that, and this 
would be a new developmental effort, a visa or visitor file could be 
developed in which these could then be stored. When the person ar- 
rives at our country at the airport or the seaport they could then 
put down one fingerprint, which could be used to verify that the 
person who the checks were done on prior to them coming to our 
country is, in fact, the person who shows up at our borders to enter 
the country. 

Additionally, that could be expanded to use that one fingerprint 
to verify, upon their departure from the country, that this is, in 
fact, the same person leaving. It would give you some kind of an 
inventory of who is here and who is not. 

Senator DeWine. So you really have the potential for two, three 
different uses, at least, different functions, different tasks. 

Mr. Kirkpatrick. Yes, sir. 

Senator DeWine. Well, we wish you well. Thank you very much. 

Mr. Kirkpatrick. Thank you. 

Senator DeWine. Mr. Belger, let me ask, I do not quite under- 
stand the FAA’s jurisdiction for airport security in regard to federal 
law enforcement and intelligence agencies. Who has what responsi- 
bility and how are you working together in light of the new world 
after September 11? 

Mr. Belger. Well, in terms of law enforcement and intelligence 
specifically, the FAA first of all is not an intelligence-gathering or- 
ganization. We rely upon the FBI and others for intelligence infor- 
mation. We do have within the FAA security organization a very 
good sophisticated intelligence analysis capability. We work very 
closely with the FBI and the CIA and others and we actually have 
people assigned full-time to those agencies as liaisons. We are con- 
stantly in touch. We get information from them. We assess that, 
along with the intelligence agencies, for application for aviation 
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purposes and then if it is appropriate, send that information out 
to the airports and the air carriers for implementation. 

Senator DeWine. Has that relationship changed since September 
11 ? 

Mr. Belger. Well, I think it has changed over the years. I think 
it is even better and closer than it was before September 11. We 
are constantly in touch to the extent that we have people at those 
intelligence agencies representing the FAA. 

Senator DeWine. You talked a little bit about the use of tech- 
nology that electronically captures fingerprints for background 
checks and it is my understanding that airports in SEAttle, Los 
Angeles, Denver, Dallas-Fort Worth, JFK, Chicago use that tech- 
nology to transmit into the database to do the background check. 

What is the plan as far as expanding the program? Question for 
either one of you. 

Mr. Belger. I will answer in terms of expanding the require- 
ment to other airports. Those large airports that you mentioned, 
they do, most of them, probably all of them, have electronic finger- 
print transmission capability, which obviously speeds up the proc- 
ess. What used to take weeks now probably takes a day or two to 
get a reading back. 

So as we had said earlier, we are in the process of putting to- 
gether a requirement that would expand the requirement to do 
criminal history records checks to all airports. We are also making 
available under the airport improvement program funding for those 
electronic fingerprint machines for any airport to purchase should 
they want to. 

Senator DeWine. What kind of cost is that? 

Mr. Belger. I am not really sure what the cost is. I do not think 
they are real expensive but I honestly do not know, per machine, 
what the cost is. 

Senator DeWine. Thank you. Madam Chair. 

Chairperson Feinstein. Thank you. Senator. 

Senator Cantwell, welcome. 

Senator Cantwell. Thank you. Madam Chair, and thank you for 
holding this important hearing. I know that your commitment and 
Senator Kyi’s commitment to this very important issue is helping 
us put a shape and, if you will, face to what we need to do in bio- 
metrics. 

I was very happy to get language added to the anti-terrorism bill 
that specifies that the Department of Justice and the Department 
of State should work together in adopting a biometrics standard to 
be used for the visa program and hopefully to be used by our allies 
abroad in also identifying people who want access to the United 
States. So I think this hearing is very helpful in talking about 
where we have been today on biometrics and how we can get that 
standard established. 

Mr. Kirkpatrick, I appreciated your testimony. I wanted to ask 
a few questions about the lAFIS system and where you have been 
today because I think actually part of that technology is perhaps 
a company that is based in Washington State that is the basis for 
that. But your system is currently fingerprint only or are you al- 
ready adding in facial recognition to the fingerprint system? 



20 


Mr. Kirkpatrick. We have the capability to store photographs in 
that system. It is at this time not searchable by photograph. How- 
ever, there is the capability to associate a photograph with a par- 
ticular set of fingerprints. 

Senator Cantwell. Do you have any idea of how many records 
like that you have? 

Mr. Kirkpatrick. No, I do not. 

Senator Cantwell. Is it 10 percent or 15 percent? 

Mr. Kirkpatrick. I do not know, no. 

Senator Cantwell. Is the FBI at a point where it is recom- 
mending that the database should be a compilation of both facial 
recognition and fingerprints or have they made that determination? 

Mr. Kirkpatrick. We would like to have a photograph associated 
with every record. We have the capability to store that, as I said. 
We need to work with our partners in state and local and other fed- 
eral law enforcement agencies to make sure that they have the ca- 
pabilities to take those photographs and associate them with the 
records and forward them on to us. 

Senator Cantwell. Given your involvement on an international 
basis, and I believe that the lAFIS system is also the basis of what 
Interpol uses so we have gotten some international standards es- 
tablished here, at least as it relates to fingerprints; is that correct? 

Mr. Kirkpatrick. FBI fingerprint transmission standards have 
been adopted by Interpol, yes, ma’am. 

Senator Cantwell. And if we were going to go to the next level 
on a broader biometric standard using both facial recognition and 
fingerprints, how do you think we should best go about that? 

Mr. Kirkpatrick. Given that there are already international 
standards for fingerprints, I believe that we would have to have 
some type of a concerted international effort to allow the routine 
sharing of those. What we have found, working with some of our 
international partners, is that many times their privacy laws are 
much more restrictive in those countries than even here in the 
United States and that has precluded routine sharing of that. 

So it is going to require, I believe, a fairly broad diplomatic effort 
to make that happen. 

Senator Cantwell. And given that you have been involved in 
that before, do you think that is the State Department? 

Mr. Kirkpatrick. We are trying to resolve that. In fact, we are 
very close with one of our international partners to being able to 
routinely exchange electronic fingerprint information with them. 
We are working with another very closely and are trying to work 
through the legalities of doing that. I am not sure at this point it 
is a State Department situation but it is certainly something that 
we would need to focus greater efforts on. 

Senator Cantwell. And is it your understanding — I think I saw 
in your testimony that all of the Interpol members have adopted 
that standard? Is that correct? 

Mr. Kirkpatrick. Interpol has adopted the FBI standard for 
electronic transmission of fingerprint information; yes, ma’am. 

Senator Cantwell. So what does that mean as far as the Middle 
East is concerned? 

Mr. Kirkpatrick. It would mean, and I think, as you will hear 
possibly later from some of the biometrics vendors, it means that. 
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for instance, fingerprint livescan machines are all developed ac- 
cording to this standard so that one company’s fingerprint capture 
machine can, if you will, talk to another company’s and that type 
of thing. It would mean that the fingerprints that are taken by an- 
other country electronically are in the same format as those here 
in the United States. It allows for a much easier sharing across 
countries of those fingerprints. 

Senator Cantwell. Thank you. 

Thank you. Madam Chair. I see my time has expired. 

Chairperson Feinstein. Thank you very much. Senator. 

Just a quick point of clarification, Mr. Belger. You mentioned 
that a rule is going to be published momentarily requiring all em- 
ployees at airports to have a criminal background check. Are these 
just employees in secure areas or all employees? And secondly, how 
many employees will that cover? 

Mr. Belger. It would be employees in two categories. The first 
category would be people who are performing the passenger screen- 
ing functions and supervisors and anybody related to that function. 
And the second category would be all employees who have 
unescorted access privileges to the secure areas of the airport. In 
other words, people who can be on the ramp or in the baggage 
make-up area, around airplanes, in those areas, before they, num- 
ber one, could be employed and number two, within a certain time 
period, they would have to go through a criminal background 
check. 

Chairperson Feinstein. And how many people does this involve? 

Mr. Belger. We have estimates at this point but the number 
that I think we are most comfortable with right now is in the 
neighborhood of 700,000 people. 

Chairperson Feinstein. I see. And are airline personnel in- 
cluded? 

Mr. Belger. Yes, they are. 

Chairperson Feinstein. Thank you very much. 

Well, we thank you both. You were very helpful. We really appre- 
ciate your being here this morning. Thank you so much. 

Senator Kyl. Senator Feinstein, I am going to have a series of 
written questions. Because we do want to complete the hearing be- 
fore noon, we need to move to the next panel but I have a series 
of written questions that I would like to get both of you to respond 
to. 

Mr. Kirkpatrick. Yes, sir. 

Senator Kyl. Thank you very much. 

Chairperson Feinstein. Thank you and we will excuse these wit- 
nesses and ask the following — Dr. Atick, Joanna Lau, Valerie 
Lyons, Bill Willis, Martin Huddart, and Richard Haddock to please 
come forward. 

I am going to, if it is all right with Senator Kyl, just proceed and 
introduce all of you at one time. Then we will begin and go right 
down the table with comments. I would ask you to keep your com- 
ments to five minutes so we will have an opportunity to ask ques- 
tions. 

I will begin on my right, the audience’s left, with Valerie Lyons 
of Identix. She serves as executive vice president of world sales of 
Identix. She was formerly president of Cytel, a privately held e- 
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business infrastructure services firm. Identix is the leading devel- 
oper of finger biometric systems and is and has already installed 
biometrics fingerprinting-based screening systems for job appli- 
cants in some of the nation’s largest airlines and airports, including 
United, Continental, JFK, and Dulles International Airports. 

Next is Mr. Bill Willis of Iridian Technologies. He joined Indian 
as chief technology officer this year, brings more than 20 years of 
technology management. Iridian is the leading developer of authen- 
tication technologies based on iris recognition, which they claim is 
the most accurate biometric identifier. 

Next is Dr. Joseph Atick of Visionics Corporation. He serves as 
chairman and CEO of Visionics, a company that produces facial 
recognition and fingerprint matching systems. Prior to founding 
Visionics he served at the Computational Neuroscience Laboratory 
at Rockefeller University and prior to that, the Neurocybernetics 
Group at the Institute for Advanced Studies in Princeton, New Jer- 
sey. He will testify on the benefits of facial and fingerprint bio- 
metrics and is therefore uniquely qualified to speak on the deploy- 
ment and benefits of both products. 

Martin Huddart of Recognition Systems serves as general man- 
ager of Recognition Systems. This company was founded in 1986. 
It specializes in the development of hand geometry biometric sys- 
tems identifying people by the size and shape of their hand. The 
company has 55,000 units installed throughout the world and 
serves clients that includes private industries, law enforcement, 
and the Olympic Games. 

Mr. Richard M. Haddock of Drexler Technology. He has been 
president since 1997 and of LaserCard, a Drexler subsidiary, since 
1989. LaserCard makes optical memory cards and high security ID 
card systems. It is employed by the Immigration and Naturaliza- 
tion Service, the Department of Defense and the State Department. 
These smartcards are variously used as multiple entry visas for 
qualified Mexican citizens, as INS permanent resident cards, green 
cards, and as U.S. Army automated manifest cards. Last month 
LaserCard received a $4.8 million order for LaserCard ID cards for 
the current U.S. border ID card program. They currently make 
about 4 million cards annually for North America. 

And then finally, Joanna Lau of Lau Technologies. She is the 
founder and CEO of Lau Technologies. This is a systems integra- 
tion company with decades of experience in the development and 
delivery of high-end electronic systems for military applications 
and secure identification and surveillance systems. Lau Tech- 
nologies and its subsidiaries provide security products to the De- 
partment of Defense, the FAA, the Department of State, and pri- 
vate industry. 

I might say that the company created Viisage Technology, which 
develops facial recognition technologies. This company’s products 
are used in a variety of ways, from screening crowds at last year’s 
Superbowl to increasing security at airports, including Fresno 
International, to producing digital licenses. 

So we will now begin with Miss Lyons and we will go right down 
the line. Welcome. 
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STATEMENT OF VALERIE J. LYONS, EXECUTIVE VICE PRESI- 
DENT, WORLD SALES, IDENTIX, INC., LOS GATOS, CALI- 
FORNIA 

Ms. Lyons. Thank you very much. Good morning, Madam Chair- 
woman, Senator Kyi. 

Identix is a biometrics company founded in 1982. We are the 
leading provider of fingerprint biometric technology for solutions 
with criminal justice, airport security and commercial markets, 
headquartered in Los Gatos, California with a significant presence 
here in the Washington metropolitan area. Our FBI-certified tech- 
nology is currently in use worldwide to identify criminals, screen 
job applicants, control physical access, protect information and pre- 
vent identity theft and fraud in cyberspace. 

Fingerprint biometrics are extremely accurate, easy to use and 
already deployed on a large scale. For example, all U.S. military re- 
cruits and current holders of California driver’s licenses already 
have fingerprint images as identification on ID cards. As you point- 
ed out though, no one is reading those cards. California teachers 
and day-care providers are fingerprinted for background checks. 

With the implementation of the Airport Security Improvement 
Act of 2000, we are proud to have helped airports comply with 
mandated security improvements for the category X airports. 
Identix fingerprint biometric solutions are now in use for back- 
ground checks at the majority of large airports. Those include Dul- 
les, Reagan National, BWI, San Francisco, O’Hare, Logan, Orlando 
and Houston’s Bush and Hobby Airports. Identix also provides ap- 
plicant screening for United, Continental and Horizon Airlines. 
This law puts in place critical safeguards against potential threats 
and we urge Congress to expand its scope to apply to all airports. 

At the back of this room — we can do demos later, as opposed to 
doing those right now — is an Identix fingerprint capture device. 
Those are used for criminal and job applicant screening at the air- 
ports that I just mentioned. In about 10 minutes time an operator 
can record a forensic quality fingerprint, 10 fingerprints, and then 
for job applicants this record is transmitted to the U.S. Office of 
Personnel Management, which forwards it to the FBI for a search. 
The results are sent quickly and confidentially to the prospective 
employers. 

Now when these fingerprints are used as part of a comprehensive 
security effort, fingerprint applicant screening can prevent persons 
from being employed in sensitive jobs who have a criminal history, 
citizenship issues, or who might otherwise be connected with un- 
lawful activity. It is important to remember that fingerprint checks 
are effective because there are databases against which checks can 
be made. Virtually all police and law enforcement networks world- 
wide and many border entry and visa control systems are finger- 
print-based. 

Fingerprint biometric applicant background checking is essential 
as the first step in authenticating employees in sensitive jobs. How- 
ever, once their identity has been established, it is important to en- 
sure that this identity is not compromised once they become em- 
ployees and have access to secure areas and computers. Today em- 
ployees are typically given a badge and the only connection be- 
tween the badge and the employee is a picture on the badge. There 
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is currently no method of ensuring that the badge owner and the 
user is indeed the person that had the background check. 

We can enhance security by putting the fingerprint image, which 
we captured during the applicant processing, on a badge, a 
smartcard, if you will, thereby creating that direct relationship be- 
tween the individual, their badge and the background check. 

This smartcard here has a chip on it and the image is on this 
card and no one can use this badge without me and my finger. 

Chairperson Feinstein. Could we take a look at that badge? 
Maybe someone could go down and bring it up; that would be very 
useful. Thank you very much. Please continue on. 

Ms. Lyons. This is a biometric doorlock. So with the fingerprint 
image on that badge, you can also prevent or allow for physical ac- 
cess to secure areas using a badge with a biometric on it. It recog- 
nizes my finger image when prompted to do so by the badge and 
it will only open for me, with my badge and my finger. 

The same is true for computers. Here is a reading device that 
can be used in concert with the badge to allow only access to my 
computer, again with my badge and my fingerprint, assuming my 
fingerprint image is on that smartcard. 

So while my testimony is focussed on personnel security matters, 
this same approach can be applied to the frequent traveler to expe- 
dite check-in, boarding for the airline travel, and other forms of 
transportation. Like the employee ID, the frequent traveler card 
starts with a form of identity-proofing as might be prescribed by 
the federal government, something clearly more than a driver’s li- 
cense but several forms of identification to do identity-proofing. The 
finger image is placed on a smartcard so that the card cannot be 
exchanged or counterfeited. 

However, unlike the employee ID, the frequent traveler card 
would keep the finger image on the card and not in a central data- 
base. This card would be voluntary. Its principal purpose is to au- 
thenticate the traveler, promote convenience and increase public 
confidence in our transportation infrastructure. 

Fingerprint biometric solutions can raise the level of security for 
travelers without further raising concerns of privacy because they 
hold the image in reference to the traveler. 

Madam Chairwoman, we appreciate having the opportunity to 
share our views with the Committee today. We commend you for 
your leadership in focussing attention on the role that technology 
can play in these challenging times. Your recently-introduced legis- 
lation promoting visa reform demonstrates another area in which 
biometric technology can be used to enhance homeland security. 
The use of fingerprint biometric technology is already widespread. 
The technology itself is reliable, cost-effective and proven. 

The challenge we all face from 9/11 is to restore safety and trav- 
eler confidence. Any solution that Congress mandates or industry 
is asked to deliver must be deployed rapidly, reliably and integrate 
with existing processes and current investment. Fingerprint bio- 
metrics delivers on all those requirements. We would be privileged 
to do whatever we can to improve aviation and homeland security 
through the application of fingerprint biometric technology and we 
look forward to continuing to work with you. 

[The prepared statement and attachments of Ms. Lyons follow:] 
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Statement of Valerie J. Lyons, Executive Vice President of Identix 
Incorporated, Los Gatos, California 

Good Morning, Madam Chairwoman, Senator Kyi, and other members of the Sub- 
committee. My name is Valerie J. Lyons and I am Executive Vice President of 
Identix Incorporated. Eounded in 1982, Identix is the leading global provider of fin- 
gerprint biometric solutions for the criminal justice, airport security and commercial 
business markets. We are headquartered in Los Gatos, California and have offices 
in Fairfax, Virginia and other cities in the U.S., Europe and Australia. Our tech- 
nology is currently in use around the world. Our FBI-certified technology for cap- 
turing and managing fingerprint images electronically is used to identify criminals, 
screen job applicants, control physical access, protect proprietary information, and 
prevent identity theft and fraud in cyberspace. 

Our fingerprint biometric solutions are extremely accurate, easy to use and al- 
ready deployed on a large scale as a standard procedure. All U.S. military recruits 
and current holders of California drivers’ licenses have had Identix finger images 
captured for purposes of identification. California teachers and day care providers 
are fingerprinted for background checks. 

With the implementation of the Airport Security Improvement Act of 2000 in Jan- 
uary, Identix fingerprint biometric solutions for background checks are now at the 
majority of large airports, including: Dulles, Reagan National, Baltimore-Wash- 
ington, San Francisco, O’Hare, Logan, Orlando and Houston’s Bush and Hobby air- 
ports. Identix also provides job applicant screening for United, Continental, and Ho- 
rizon airlines. This law puts in place critical safeguards against potential threats. 
We urge Congress to expand its scope to apply to all airports. 

On display is the Identix fingerprint capture device used for criminal and job ap- 
plicant screening at the airports I just mentioned. In the law enforcement commu- 
nity this is known as a “livescan” or “tenprint” machine. Using this machine, the 
screening process is simple and straightforward. In about 10 minutes time, an oper- 
ator can record forensic quality electronic images of the applicant’s full ten finger- 
prints. For job applicants, this record is submitted electronically to the U.S. Office 
of Personnel Management, which in turn forwards the record to the FBI for a search 
of its Integrated Automated Fingerprint Identification System, known as the 
“lAFIS”. The results of the lAFIS search are transmitted confidentially to the pro- 
spective employer within a window of time that varies from a few hours to no more 
than 72 hours. A search of this sort costs approximately $35 to $50 per applicant. 
The cost of the machine ranges from $20K to $40K depending on the functionality 
desired. 

When used in a timely manner as part of a comprehensive security effort, finger- 
print based job applicant screening can prevent persons from being employed in sen- 
sitive jobs who have a criminal history or are otherwise wanted in connection with 
unlawful activity. It is important to remember that fingerprint checks are effective 
because there are existing, “back-end” databases storing fingerprints against which 
checks can be made. Virtually all police and law enforcement networks worldwide 
and many border entry and visa control systems are fingerprint based. There is a 
worldwide network of skilled, professional fingerprint examiners and a core set of 
systems that are maintained and updated routinely, as a matter of standard prac- 
tice. 

Fingerprint biometric based job applicant background checking is an essential 
first step in authenticating employees in sensitive transportation and critical infra- 
structure related jobs. However, once this form of identity has been established for 
workers it is important to ensure that their identity is not compromised once they 
become employees and have access to secure areas and computers. 

In many so-called secure enterprises today, employees are given an ID Badge for 
access purposes, however, this method does not ensure that the badge owner and 
user is in fact the person whose background was checked. 

To test the integrity of any badging system we can ask 5 simple questions: 

1) Is the employee who was cleared by the FBI the same person who re- 
ceives the badge? The answer should be yes. 

2) Is the rightful badge owner the same person gaining access through a 
door to a secure area? The answer should be yes. 

3) Can the badge owner gain access through a door to a secure area without 
a badge? The answer should be no. 

4) Is the rightful badge owner, the same person gaining access to a com- 
puter? The answer should be yes. 

6) Can the badge owner gain access to a computer without a badge? The 
answer should be no. 
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We can enhance security through the concept of “continuity of authentication” for 
an individual’s identity through the direct relationship between an individual, their 
badge, and the background check. 

Allow me to demonstrate. On display is the fingerprint based job applicant system 
machine. Here is a smart card ID badge, with a fingerprint image on it. The back- 
ground check results and my badge are tied together because they both have the 
image of my finger. No one else can use this badge without me. 

This is a biometric door lock control. It can recognize my finger image when it 
is prompted to do so by this badge. It will only open for me with my badge and my 
finger. The same holds true for my computer. I insert this badge into a biometric 
enabled card reader that scans my finger and only I can enter a computer and exer- 
cise only the authorities assigned to me. 

The “continuity of authentication” through biometric based badging offers greatly 
improved security that can be conveniently added to many existing systems for a 
relatively low cost. This approach can serve as a first line of defense against individ- 
uals who want to infiltrate airport facilities or other critical parts of the transpor- 
tation infrastructure. 

The U.S. Department of Defense paid $6 per card for smart card stock such as 
this. A computer can be locked down with biometric readers and software that are 
commercially available from most major brands of computer makers for about $100. 
Doors cost about $1000 per door in volume. Biometric based badging takes the next 
logical step to ensure that precautionary measures are in place in a way that maxi- 
mizes background checks and physical access controls. 

This technology and the concepts associated with it can be quickly implemented 
in transportation enterprises through timely and coordinated policy and manage- 
ment control. The General Services Administration has made smart ID badges 
available to the Executive and Legislative Branches through several vendors. Con- 
gress and the Administration should examine the merits of using biometric badging 
systems to improve the security of physical and computer access control systems in 
government buildings. 

While my testimony has focused on personnel security matters, our approach can 
also be applied cheaply and conveniently to the frequent traveler to expedite check 
in and boarding for airline travel and other forms of transportation. Like the em- 
ployee ID, the frequent traveler card starts with some form of identity proofing, not 
necessarily an FBI check, perhaps a bank process using applicable authority to 
check personal records. Also like the employee ID, a finger image is placed on a 
smart card so that the card cannot be swapped or counterfeited. 

However, very much unlike the employee ID, the frequent traveler card would 
keep the finger image on the card and not in a central database. Also unlike a man- 
datory employee ID, a frequent traveler card would be voluntary, its principal pur- 
pose being to promote convenience and increased public confidence in the U.S. 
transportation infrastructure. There are very real privacy concerns with respect to 
the array of security solutions being considered. Identix believes that we can raise 
the level of security for travelers without undermining civil liberties. 

Madame Chairwoman, we appreciate having had the opportunity to share our 
views with you and your colleagues today. We commend you for your leadership and 
vision in focusing attention on the role that technology can play in these challenging 
times. Your recently introduced legislation promoting visa reform demonstrates an- 
other area in which biometric technology can be used to enhance homeland security. 
We would be privileged to do whatever we can to improve safety and security in 
our nation through the application of biometric technology. We look forward to con- 
tinuing to work with you. 

Thank you very much. 
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Securing our Airports and Air Travel 

PREPARED BY IDENTK, INC. 

IDENTK AUTHENTICATES PEOPLE FOR SECURE AND TRUSTED ACCESS 
AUTHENTICATING PASSENGERS AND PERSONNEL 
SECURING PHYSICAL AND COMPUTER ACCESS 

Overview 

The seemingly impossible — four hijacked US airplanes and the ensuing tragedy — 
has proven all too real. In the aftermath, airport security has gone under the micro- 
scope for examination. And there is a common realization that restoring safety, se- 
curity and trust to airline travel is critical to our National defense and public psy- 
che. 

However, it is important to realize that airport security concerns have been esca- 
lating for some time. Not only are airports “attractive targets” for terrorist activi- 
ties, they also serve as magnets for criminal activities such as theft and smuggling. 
At the same time, airline and airport reliance on computer systems has opened the 
virtual door to hackers as another threat to our skyways. 

Providing protection against these threats presents a special challenge. Because 
airports support activities that are both public — passengers, visitors and airport em- 
ployees — and private — such as air cargo and mail — these locations are part trans- 
portation hub, shopping mall and industrial complex. As a consequence, require- 
ments for public safety and security are a hybrid of both commercial and industrial 
needs similar to a small or medium-sized U.S. town or city. 

The resulting challenge is to balance security, safety and government regulatory 
compliance with the privacy rights and convenience of individuals. Addressing this 
challenge is the lynchpin of Identix’ airport security solution. Today, Identix is the 
leading provider of biometric security solutions for airports and other government- 
regulated organizations. 

Identix — Airport Security Components 

The Identix airport security approach components consist of products available 
today that can be integrated to: 

Screen airport and airline workers before hiring to ensure no past criminal 
history; 

Grant physical access rights to different airport locations easily; 

Control access to computer systems; and, 

Uniquely link passengers to their boarding pass, baggage and passport con- 
trol. 


Fingerprint Biometrics 

The approach is based on two Identix core technologies: fingerprint biometric soft- 
ware and hardware tied to the itrust access control platform. 

Identix is the leading provider of finger biometrics for the criminal justice, airport 
security and enterprise markets. Its technology is used to identify criminals, screen 
job applicants, control physical access, protect proprietary information, and prevent 
identity theft and fraud. Several million fingerprint templates have been enrolled 
using its technology. Finger biometrics are accurate, easy to administer and conven- 
ient. 

The itrust Internet access control platform supports multi-factor authentication, 
including finger biometrics, smart cards, facial recognition, etc. In addition, itrust 
is a complete authentication, authorization and transaction management solution 
that allows an airport to establish strict multifactor authentication policies to en- 
sure the identity of the end-user while maintaining the confidentiality of the infor- 
mation. 


Identk Offers a Full Range of Components Today 

No other company offers physical, logical and passenger/personnel screening using 
the same method — the human finger — for immediate and cost effective implementa- 
tion. Identix provides: 

Positive identification and protection of privacy against ID theft; 

Finger biometrics that are convenient, reliable and cost effective; 
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Criminal history identification database inquiries; 

FBI-certified products; 

Technology options and form factors to meet your needs; and, 

Easy to use, comprehensive systems administration capabilities. 

Identix — Leader in Providing Biometric Products to Government 

Identix has been working with airports and government agencies regarding appli- 
cant screening for over 6 years. Already, the company has installed job applicant 
security solutions to the nation’s largest airports including JFK International, Dul- 
les International, Boston Logan, Chicago O’Hare International, Baltimore-Wash- 
ington International, Reagan National, Orlando International and San Francisco 
International. 

The Identix/Sylvan joint venture handles all job applicant screening for United, 
Continental and Horizon Airlines and a substantial portion of the American Trans- 
portation Association’s screening needs. 

Because of airport security concerns. Congress has mandated a high level of secu- 
rity vigilance and recent events promise even more legislation. For instance, the Air- 
port Security Improvement Act of 2000 took effect in early 2001. This new law clear- 
ly signaled Congress’ intent to improve passenger safety and airport security in the 
following areas: 

Criminal history background checks for all airport employees coupled with 
identification badges for secure areas; 

Restricted access to certain areas; 

Baggage and cargo loading inspection; and. 

Passenger screening to airport concourses. 

Identix’ airport security products not only address this recent mandate but also 
extends the security net to passenger authentication. 

Airport and Airline Employee Identification and Access Control 

Airport security begins with the people who work there. It is critical that employ- 
ees be citizens in good standing with no past criminal history. For optimum secu- 
rity, physical and network access should be controlled based on specific require- 
ments of the job. The Identix approach addresses these issues and integrates identi- 
fication with access control. 

Personnel screening. Before an employee is hired — baggage handlers, airport ven- 
dors, ticket agents, etc. — background checks are performed using fingerprint images 
which are electronically submitted to the FBI’s Integrated Automated Identification 
System (AFIS). 

Employee ID issuance. Once an employee has passed the background check, de- 
mographic information can be matched with fingerprint templates stored in a cen- 
tralized ID management server database and on a smart card. 

Integrated physical and network access authorization. The centralized ID manage- 
ment server database defines each employee’s authorization access path that in- 
cludes both physical access and networks. Access to both physical locations and net- 
work nodes can be authorized for each location or PC and can require integrated 
access control. For instance, pilots may have access to the cockpit and all doors; res- 
ervation staff to internal terminal doors but not baggage areas and specified PC ter- 
minals; baggage handlers may be restricted to a few doors in certain areas, etc. A 
combination of multifactor authentication types may be applied depending on secu- 
rity requirements. 

Roaming airline employee authorization. Pilots, flight attendants and other airline 
personnel routinely travel from airport to airport requiring authorized access to sev- 
eral locations. Identix provides a platform which can recognize and handles remote 
authentication and authorization. 
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Secure Passenger Travel System 

Day in the Life of a Secure E-Traveler 


Customer Check-In 
Authentication 


Baggage to 
Passenger Match 


Passenger Intake Passenger 
Authentication Boarding 



Traveler Checks-in; Traveler 
authenticates identity based 
on a unique characteristic, a 
fingerprint template stored on 
a smart card. 


While Traveler was checking 
in. her unique luggage bar 
code number was securely 
stored on the frequent travel 
smart card- 


Once bags have 
been approved, the 
fraveler then goes to 
a Passenger Intake 
chamberwhere only 
authorized 
passengers are 
allowed. 


Passenger security requires knowing who the passenger is, where they go and 
what they have with them. This involves a continuous, exact match of travelers and 
their bags to an aircraft passenger manifest. 

Frequent flyer ID card. As a service to frequent flyers who comprise almost 70% 
of air travelers, membership cards can include fingerprint templates that allow road 
warriors to move from one airport to another quickly. Because the smart card re- 
quires re-authentication — a touch of a finger — at each secured access point, security 
is not compromised and customer loyalty rewarded. 

Check-in identification. When a passenger purchases a ticket at the counter or 
electronic ticketing kiosk, background checks are performed to identify known ter- 
rorists or criminals using automated fingerprint images that are electronically sub- 
mitted to a database of known terrorists or criminals. Once a passenger has passed 
the background check, the fingerprint template is stored on a smart card or 2D bar 
code on the passenger’s boarding pass. 

Baggage control and matching. At the curb or at the ticket counter, each baggage 
claim ticket is marked with the passenger’s same fingerprint template stored on a 
smart card or 2D bar code on the boarding pass. Now, airlines can easily and accu- 
rately match passengers on board with baggage in the hull. Upon arrival, matching 
the baggage claim ticket to the passenger can be accomplished in seconds. 

Boarding identification. Knowing that passengers boarding a plane have been 
identified and cleared is crucial to security. At the gate, as the boarding pass is in- 
serted into the kiosk, the passenger is authenticated once more using a smart card 
or 2D bar code on the boarding pass. This final step validates the passenger mani- 
fest and protects passengers from known criminals and terrorists. 

Immigration, Passport and Visa Administration 

Access to the U.S. from many countries usually requires a Visa. Imagine the value 
of identifying foreign visitors prior to a trip and linking identity to airline ticket and 
passport control. At the same time, native born and naturalized citizens can enjoy 
added security as they travel from country to country. Currently, some countries 
have already deployed Identix solutions for immigration control. 

Visa and passport issuance. At time of issuance, travelers’ background can be 
checked using automated fingerprint images and submitted to the FBI (or other 
agencies such as the INS) for a criminal and terrorist history check. The fingerprint 
template is stored on the Visa or passport as a 2D bar code or magnetic stripe or 
smart card. 




33 


Clearing customs. Upon country entry or exit, the passenger is re-authenticated 
with a touch of a finger and compared to the template stored on the Visa or pass- 
port. The process takes seconds and validates that the passenger is not a known 
terrorist or criminal. 

Identix Balances Privacy Rights with Security 

Today, everyone understands the need for higher levels of security to protect the 
lives of travelers, visitors, and the airline and airport personnel who serve them. 
Yet the question remains, “At what cost to personal privacy?” Identix is committed 
to delivering biometric solutions that place a priority on maintaining individual pri- 
vacy. At the same time, Identix provides the flexibility to engage and enhance secu- 
rity measures on an as-needed basis, so that security is appropriate to a person’s 
particular role. 

Identix believes in protecting an individual’s privacy. Our minutiae-based algo- 
rithms analyze the position of the end points and junctions of print ridges and cre- 
ate fingerprint templates — mathematical representation of the print characteristics. 

For identifying criminals or terrorists, the templates are used for identification 
purposes — the process of selecting one person’s characteristics from a group of 
records. Called a “one-to-many” search, the question put to the system is, “Do you 
know this person?”The algorithm searches the database and returns a result of like- 
ly candidates. If no match is found, the template is deleted. 

Verification, on the other hand, occurs when a person makes a claim to a specific 
identity. Called a “one-to-one” match, the question put to the system is, “Is this per- 
son who he claims to be?” The automated system compares the individuals meas- 
ured characteristics against a previously registered record to determine whether the 
match is valid. The templates are used for matching purposes only and are de- 
stroyed at the match point. 

Of course, the effectiveness of technology is determined by the people who imple- 
ment it and create policies for its use. For this reason, Identix is committed to work- 
ing with officials from airlines, airports and government agencies, as well as mem- 
bers of Congress and other policymakers, to implement biometric security practices 
that maximize safety while preserving privacy. 

Identk — ^Architects of Authentication 

Founded in 1982, Identix Incorporated (AMEXTDX) develops, manufactures and 
markets the world’s leading finger biometric software, hardware and services and 
an open Internet access control platform. Identix solutions are installed worldwide 
to protect proprietary information, prevent fraud and identity theft, identify crimi- 
nals, control physical access, safeguard airports, screen job applicants and protect 
patient records. The leader in biometric technology, Identix believes it has enrolled 
millions of fingerprint templates worldwide. 

Identix’s products and services are categorized into three major groups: 

Finger biometrics — Used in the enterprise to verify the person is who they say 
they are, Identix biometrics protect PCs, laptops, servers and PDAs from fraud and 
unauthorized access. Law enforcement and other government agencies use our bio- 
metrics to create forensic-quality images that can be transmitted directly to APIS 
or other identification bureaus. 

itrust — Internet access control platform leverages the efficiency of conducting 
business over the Internet while ensuring the trust and integrity of transactions 
with complete authentication, authorization and administration tools. 

Consulting services — IT security, engineering sciences and complex project man- 
agement services to the public and commercial sectors. 

Air Travel Safety and Security Recommendations 

1) Expand the Airport Security Improvement Act of 2000 to All U.S. Airports. The 
Act requires an FBI fingerprint background check for any individuals applying as 
a security screener, a screener supervisor, or one with privileged access to secure 
areas of an airport. The Act currently applies only to the 20 largest airports in the 
U.S. It should be expanded to include all airports in the U.S., regardless of size. 

2) Implement a Biometric System to Identify Those with Legitimate Access to Air- 
craft, Equipment, Computers and Secure Areas within an Airport. Even before the 
September I I attacks, there were concerns raised about the level of physical and 
computer access security for-airport personnel. GAO investigators were able to cariy 
weapons around two airport security checkpoints using phony credentials. Biometric 
technology, specifically fingerprint imaging, is currently being used to control per- 
sonnel access at Chicago’s O’Hare airport. Congress and the administration should 
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adopt legislation that would require the FAA to use fingerprint and other biometric 
devices to control physical and computer access at airport facilities. This effort could 
be accomplished through the use of a smart card ID badge issued to personnel con- 
taining a biometric identifier. With a fingerprint image biometric, based on an FBI 
background check, a lost or stolen card cannot be used by anyone else. 

3) Create an Electronic Watch List of Suspected Terrorist by Integrating Federal 
Agency “Back End” Databases. One of the current passenger information short- 
comings is the lack of coordination and communication among the various agencies 
monitoring, screening and finding suspected terrorists. So called “watch lists” are 
only as good as the “back end” databases and networks to which they are linked. 
Congress and the Administration should authorize the integration of these data- 
bases in order to create a more accurate and timely “watch list” of suspected terror- 
ists and others involved in criminal activity. The INS, FBI, State Department, 
Interpol and relevant Intelligence agencies should be party to the database integra- 
tion effort. 

4) Require a Biometric Enabled Match Among Passengers, Boarding Pass and 
Baggage. One of the fundamental elements of airport security is information on who 
passengers are, where they go, and what they have with them. The recent attacks 
were a direct result of passengers on planes. In the wake of the TWA Flight 800 
disaster, the govermnent commission analyzing findings called for a higher standard 
of passenger identification that ties the traveler to his or her baggage, boarding pass 
and flight manifest. This “iron triangle” of identity authentication provides: positive 
identification of all travelers at all points in the airport, including the gate; account- 
ability for all checked baggage against boarding pass, and; complete and accurate 
passenger manifests. Congress and the Administration should adopt legislation that 
requires a standard for airline passenger identification derived from the principles 
of the “iron triangle” concept, thus enhancing airport and traveler security. 

Chairperson Feinstein. Thanks very much, Miss Lyons. 

Mr. Willis? 

STATEMENT OF WILLIAM WILLIS, CHIEF TECHNOLOGY OFFI- 
CER, IRIDIAN TECHNOLOGIES, INC., MOORESTOWN, NEW 

JERSEY 

Mr. Willis. Good morning, Madam Chairman, Senator Kyi. I ap- 
preciate the opportunity. 

I am representing Iridian Technologies. We are the developer of 
iris recognition technology, a superior biometric authenticator that 
can do both verification and identification. As part of our biometric, 
we do not require having a card. We can actually search a database 
very quickly in a matter of a couple of seconds and millions and 
millions of people. So you literally would not have to carry a second 
piece of identification. You just carry your eyes with you, if you 
will. 

We are able to do that by taking a simple picture of the eye with 
a regular camera that is enhanced to be able to give a good quality 
component of the iris, which is the colored part of your eye. We are 
able to then do the authentication and make sure that it is totally 
distinct, as you said earlier, from any other person in the world. 

Senator Kyi made a comment on how we could help specifically, 
if you will give me a moment. How can we use this for terrorist 
information? An example would be being able to put that at the 
borders of our other countries, be able at the visa point to take the 
picture of the iris, put that in a central database which only takes 
a few seconds, and I will be happy to show that to you, and then, 
at the time that they come back into the country, do the same test. 
You can then either do that with the card or without a card. That 
will be actually up to you in the deployment and in the cost sce- 
nario. If you choose to eliminate the cost of the card, you would not 
have to do that. 
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There are numerous third-party studies which are available upon 
your request that confirm that the iris is the most information-rich 
and accurate biometric. Indian has developed these proprietary 
technologies to take advantage of the natural characteristics of the 
human iris to produce products both in physical and information 
security. Again I will show you in my five minutes both those 
things. 

The technology is widely deployed today for both physical secu- 
rity in corporate America and in the United States government. 
New imaging products for major manufacturing partners of Indian 
have created a situation where products are ready for deployment 
today on a very large scale. 

Iris recognition is a natural identification component of anti-ter- 
rorist security systems. It is capable of high-speed, real-time, ex- 
tremely accurate operations in a very large database environment, 
such as immigration and border security, national transportation 
system security, information network protection, and access control 
for security of critical infrastructure assets. 

I have some examples of that. Schiphol Airport in Amsterdam, 
Netherlands is doing that for immigration control of the European 
Union, Heathrow Airport in London in the United Kingdom and 
Douglas International Airport again in Charlotte. 

The tragedies of September 11 have made us keenly aware of the 
fragility of our nation’s infrastructure. Iris recognition technology 
can rebalance the equation of open access and controlled access 
without sacrificing the rights of privacy and free movement in our 
society. Americans now understand that it is in the country’s best 
interest to manage access to America’s infrastructure by applying 
technology in a way that is efficient, reliable and trustworthy and 
Indian Technologies standards ready to make its innovative prod- 
ucts available to do that. 

Chairperson Feinstein. Thanks very much, Mr. Willis. 

Mr. Willis. I have — 

Chairperson Feinstein. Would you like to show that? 

Mr. Willis. I would like to show that in my five minutes. That 
is why I cut it short. 

Chairperson Feinstein. Proceed. You have your five minutes. 

Mr. Willis. Hopefully I answered the question that you had. 
Senator. 

Two quick ones. I will be able to log on. I have just looked at the 
camera. It has seen me, it knows that it is Bill and it is logging 
me onto the computer. This is what we see for information security. 
Obviously the physical security is only as good as the network in- 
frastructure you are going to put on it so you make sure that the 
terrorism is not only at the physical layer but also at the informa- 
tion layer, as well. You can see that I can from a very comfortable 
distance be able to run this. I will be able to now use this. We see 
this as an example of being able to take access badge-readers off 
of places that are secure, be able to put the camera — you do not 
need the second factor, which would be a card — and be able to en- 
roll. 

As you can see, in a couple of seconds you have a picture of my 
eye and at the same time we have the ability to do an unlimited 
database search. So instead of a day or a few hours, you literally 
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could have the response within a few seconds if there is someone 
that would be suspected of looking into farther. 

[The prepared statement of Mr. Willis follows:] 

Statement of William Willis, Chief Technology Officer, Iridian Technology, 

Inc. 

Iridian Technologies, Inc. (Iridian) is the developer of iris recognition technology, 
a superior biometric authenticator that performs either verification or identification 
of a claimed identity. Identification is accomplished by a complete search of a data- 
base using a mathematical representation created from the image of the iris in the 
human eye. Images of the iris, the colored ring around the pupil, are acquired by 
a camera at a comfortable distance, and converted by algorithm into a secure 
IrisCode. This IrisCode is used as a template for comparison when a new eye is pre- 
sented for authentication. Iris recognition technology is totally distinct from an ear- 
lier and unrelated approach, retinal scanning. Retinal scanning relies on an active 
laser probing inside the eye to view the retina at the back of the eye. Iris recogni- 
tion uses the external colored part of the eye via a simple photographic image. 

Numerous third party studies [available upon request] have confirmed that the 
iris is the most-information rich biometric. Iridian Technologies has developed pro- 
prietary technology to take advantage of the natural characteristics of the human 
iris to produce products that support both physical security and information security 
applications. Iris recognition was in development from the mid-80’s, and its first 
products for physical security were deployed in 1996. The technology is widely de- 
ployed today for physical security in corporate America and the government. New 
imaging products from major manufacturing partners of Iridian Technologies have 
created a situation where the products are ready for deployment on a large scale. 

Iris recognition is a natural identification component of anti-terrorist security sys- 
tems. It is capable of high-speed, real-time, extremely accurate operations in very 
large data base environments such as Immigration and Border security, National 
Transportation system security, information network protection, and access control 
for security of critical infrastructure assets. Examples of scalable deployments in- 
clude Schiphol Airport, Amsterdam Netherlands, Heathrow Airport, London United 
Kingdom, and Douglas International Airport, Charlotte North Carolina. 

The tragedies of September 11 have made us all keenly aware of the fragility of 
our nation’s infrastructures. Iris recognition technology can rebalance the equation 
of open access and controlled access without sacrificing the rights of privacy and 
free movement in our society. Americans now understand that it is in the country’s 
interest to manage access to America’s infrastructure by applying technology in a 
way that is efficient, reliable, and trustworthy. Iridian Technologies stands ready 
to make its innovative products available to achieve these ends. 

Chairperson Feinstein. Thank you very much. Very interesting. 
Thank you. 

Dr. Atick? 

STATEMENT OF JOSEPH J. ATICK, CHAIRMAN AND CEO, 
VISIONICS CORP., JERSEY CITY, NEW JERSEY 

Mr. Atick. Good morning everyone and thank you for inviting 
me to share with you my views regarding this timely subject. 

I am the CEO and chairman of Visionics. Visionics is a company 
that has pioneered fingerprinting, as well as facial recognition. We 
supply livescan technology to all of the INS today, so all immi- 
grants today that apply for citizenship have to touch the surface 
that we make to authenticate or to check that they do not have a 
criminal record. We are in about half of the category X airports in 
about 600 police departments and 300 courts. 

That is not the part of the business that excites me because I see 
now a new generation of innovative technology in the area of 
fingerprinting that we are producing, which has to do with mobil- 
ity. It has to do with the ability to deploy on-demand identification 
in the field. We have deployed in California for the first time ever 
in October a technology that allows officers in the field to capture 



37 


fingerprints, as well as facial images on a mobile device and to sub- 
mit them to the local as well as the federal databases to establish 
if somebody is wanted for a crime. The first week of operation 
alone has produced 100 identifications of criminals, including six 
fugitives who were wanted for major drug warrants and out- 
standing warrants. So this is the power of identification and I 
think with innovative technology we can deliver it. 

I want to focus on the other side of our business, which is the 
facial recognition part. This is a technology that I have been inti- 
mately involved with for the last 14 years when I used to be a sci- 
entist at Rockefeller and Princeton and it has to do with the ability 
of a computer to establish somebody’s identity by looking at their 
image and measuring the physical structure of their face. 

The way we are proposing to implement this technology in an 
airport environment would be to use standard video cameras that 
are attached to the frame of the security checkpoint. As people 
walk through that frame, the technology in real time and continu- 
ously, at a distance in motion, will capture every face, will scan 
every face, convert it into a mathematical code called your 
faceprint. Your faceprint is a very small amount of data, about 84 
bytes of data, shorter than a quick e-mail message that you send 
to a friend, but it contains the physical measurements of your skull 
and your face and it is identity-specific. It is unique to you, it does 
not change with aging and it is not affected by viewing conditions 
and also not affected by superficial disguises. If you put facial hair, 
mustache, beard, change your hairstyle, that is not what the facial 
print is doing. 

So what you can do is submit that faceprint automatically 
against a database of known terrorists and criminals so that you 
can ensure that every person boarding the plane has been checked 
against that database. If a match happens, an alarm sounds in an 
alarm-monitoring station, either at the airport or somewhere cen- 
trally, and then you can dispatch a message to the security at the 
checkpoint and say please interview this passenger because his fa- 
cial structure matches a terrorist. It does not create new lines and 
it does not inconvenience the traveling public. It is just behind the 
scenes, matching faces against the watchlist. 

Chairperson Feinstein. Is it instantaneous? 

Mr. Atick. It is instantaneous. It does a million matches a sec- 
ond, so you cannot even measure the time it does it. But there are 
concerns and I would like to address them very quickly. This is, in 
my opinion, a powerful tool that should be added to the list of tools 
that we use at the airports, including the luggage scanning and the 
metal detectors, but there are two concerns that you have heard 
about and you will continue to hear about as you consider this 
technology. One is the concern for privacy and the other one is the 
concern for accuracy. 

The concern for privacy has to do with the misconception that 
this is an ID system that is identifying every one of us. This is not 
a national ID system. It does not identify you or me. It is simply 
a criminal and terrorist alarm. If your face does not match one on 
the database, on the watchlist, there will be no alarm. There will 
be no record of you even going through the system. If there is a 
match, then somebody investigates. The key here is that Congress 
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should make sure that watchlists do not get expanded to include 
noncriminals. 

On the issue of accuracy, I want to say that you may have been 
hearing a lot of conflicting statements, either from vendors or from 
people who have specific agendas. The fact is it is very hard to an- 
swer the question of how accurate is facial recognition in a respon- 
sible short sentence because it depends on the quality of the im- 
ages and the degree of control that you can implement on the imag- 
ing environment. 

Using databases that are available to the FBI and using that 
type of quality, which is all we have today, we have done extensive 
benchmarks since September 11 and we believe, as a responsible 
company, we believe we can deliver the probability of capture of a 
terrorist between 60 to 90 percent probability. I am not saying that 
this is the accuracy of facial recognition. I am saying given how bad 
the images are in the FBI databases, we can give you confidence 
that 60 to 90 percent of terrorists will be spotted as they go 
through metal detectors and checkpoints, with very low false alarm 
rate. 

This, in my opinion, is a phenomenal performance because it 
means that it will deter terrorists from entering into these areas 
because there is a high probability if they do, they will be captured. 

One final point. A lot of improvements are being done in this 
area. DARPA is funding a major initiative called Human ID at a 
Distance, which we are part of, and we are in the process of begin- 
ning to install at two U.S. airports next week, including a category 
X airport. We have been in Kefiavik Airport for a couple of months 
now and the belief we have is that the experience we have gath- 
ered is going to allow us to form a consortium of airports that will 
be tied in together and submitting against a common database. We 
believe we will be able to work as an industry with the FBI and 
the FAA to establish standards, as well as potentially down the 
line a better understanding that would help them mandate this ca- 
pability. 

My final sentence is that as a scientist, I am proud to say that 
we have as a country a technology that can make the difference in 
the war against terror and we can make it responsibly and peace- 
fully and I would like to see us as a nation embarking in evalu- 
ating this technology. 

[The prepared statement of Mr. Atick follows:] 

Statement of Dr. Joseph J. Atick, Chairman and CEO, Visionics Corporation, 
Jersey City, New Jersey 

Let me begin by stating what I see as the corner stone of our defense, as a civ- 
ilized world against crime and terrorism in this new era: 

“I believe it is our ability — in the context of a free society — to identify those who 
pose a threat to public safety and to prevent their actions.” 

Essential to the success of this defense strategy are two ingredients: 

(1) Intelligence Data 

(2) Identification Technology such as facial biometrics 

Fact is, terrorists do not emerge overnight. They require indoctrination and con- 
stant reinforcement over an extended period of time. This affords intelligence agen- 
cies opportunities to establish identities of many of them and to build watch lists. 
Ultimately terror is not faceless. 

Today, even without systematic cooperation between intelligence agencies there 
are watch lists that contain large numbers of terrorists and fugitives. Check out the 
FBI’s website for the monthly posting’s of fugitives. 
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According to published news reports — two of the terrorists in the September 11 
hacking were already on a watch list and were sought by the FBI since August 23, 
a third was already known to the French authorities. I suspect we will find out sev- 
eral others were already known either to the Germans, Belgium, French, British or 
Israeli intelligence organizations. 

While there is no guarantee that all terrorists will be known in advance — at the 
very least we have the responsibility to try to prevent the actions of the thousands 
already known. 

Given a watch list, the question becomes: does the technology exist that can spot 
these individuals as they enter a country or attempt to board a plane? 

The demands on such a technology are very high make no mistake about it. Such 
a technology has to be able to: 

(a) Scale: in the sense that it should work across many security checkpoints at 
hundreds of airports and borders and not just one location. 

(b) Sift through more than 600 million travelers per year in the US alone and spot 
terrorists and criminals among them without interfering with passenger flow or 
throughput. 

(c) Function without infringing on the rights or inconveniencing the honest major- 
ity. 

The good news here is that such a technology exists. It is computerized facial 
scanning such as the Facelt® face recognition technology. I can speak about this 
technology because I am not only the CEO of Visionics, the company that has pio- 
neered and commercially developed this technology but I am one of its main inven- 
tors. I have worked on facial recognition and identification technology over the last 
fourteen years starting with my days as a Head of Two research Laboratories in 
Academia. 

The technology works as follows: Facelt® automatically detects faces in the field 
of view of a standard video camera, in motion, at a distance and without subject 
participation. It converts each visible face into a mathematical code, which captures 
the relative measurements between the landmarks of the human face — know as the 
faceprint. 

The faceprint is a code that only a computer could interpret. It is encrypted and 
cannot be used to reconstitute the image of the face. It is unique to a given face 
and it does not change with age, lighting or viewing conditions. It ignores facial hair 
or other superficial changes to the face. In a sense it is a fingerprint in your face. 

The extracted live faceprint is automatically sent via the network to a watch list 
database-residing either locally at the airport or centrally say in Washington. If a 
match exceeds a certain confidence threshold, then a human operator at the control 
room confirms the match and alert local security guards to intercept and interview 
passenger. The whole process could be a few seconds. If there is no match then there 
is no memory — the image is dropped. 

The system does not record, store or alter the watch list database in any way. 
The watch list database cannot be hacked into as it only accepts faceprint queries 
through the network. 

Over the years, in the world of aviation security we have seen successive tech- 
nology adoption to enhance security. Today at the security checkpoint. X-ray luggage 
scanners, metal detectors and chemical trace detectors are deployed to check for con- 
cealed weapons and explosives on our body or in our carry-on luggage. I see facial 
scanning and matching against a watch-list as an integral component in tomorrow’s 
airport security systems. 

It is time to ensure that airports are no longer safe havens for criminals and ter- 
rorists. The American public agrees. In a recent Harris Poll conducted after Sep- 
tember 11, 86% endorsed the use of facial recognition to spot terrorists. 

Still there are some questions regarding this solution that have come come. 

I would like to quickly address two: 

(1) On the issue of privacy: It is important to emphasize that the Facelt® surveil- 
lance system is not a national ID, it does not identify you or me. It is simply an 
alarm system that alerts when a terrorist on a watch list passes through a metal 
detector at the airport. If there is no match, I repeat there is no memory. 

Furthermore, such a system delivers security in a non-discriminatory fashion. 
Facelt® technology performs matches on the face based on analytical measurements 
that are independent of race, ethnic origin or religion. It is free of the human preju- 
dices of profiling. 

We have gone further and have called for Congressional oversight and for Federal 
legislation to ensure that watchlists contain only individuals who threaten public 
safety and to penalize for misuse of such technology down the line. Congress will 
take action in due time but at the moment their priorities are focused on the real 
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and present danger of terrorism and not the theoretical potential for misuse down 
the line. 

(2) Another question concerns the accuracy of facial recognition 

How accurate is facial recognition? 

There is no responsible short answer to this question as it depends on the quality 
of the images in the database and the degree of control. It also depends on whether 
you are performing 1-to-l or 1-to-many matching and whether you can enroll people 
or must use existing images for watchlist. We believe facial recognition is as accu- 
rate as fingerprinting if you have control over all these variables. In the airport ter- 
rorist and criminal alarm scenario we do not have the luxury of enrolling terrorists, 
we have to use the information available to intelligence agencies. 

We recently conducted scientific benchmarks on existing and simulated terrorist 
watchlists and they show that the probability of spotting any given terrorist can be 
in the 60-90% with low false alarm rates. This is phenomenal because it means that 
the majority of the terrorists and criminals will be spotted using current technology. 
This will deter terrorists from attempting to board planes because if they do there 
is a high probability they will be caught. 

So we must think of facial recognition at airports as a tool like the metal detectors 
and luggage scanners are tools. They enhance security tremendously without being 
technologically perfect. A facial scanning system at the security checkpoint will alert 
security to investigate just like they do today when the metal detector beeps. 

I would also like to point out that facial recognition is constantly evolving and 
advancing. The state of the art today is a quantum leap of where it was even a year 
ago let alone 5 years ago and of course with the accelerated R&D initiatives under- 
way the technology will rapidly become even more reliable and robust. Facelt® has 
already been used in real world environments and has produced significant bene- 
fits — Mexican Election System, police Mugshot systems in many places around the 
world, Criminal Alarm systems in London, Birmingham, England, Iceland Inter- 
national Airport, Tampa and so on and we are seeing accelerated real world adop- 
tion based on a real value proposition. 

This week we have announced that we are beginning to install facial recognition 
technology at two US airports including one Category X airport. The two airports 
will remain unnamed until the installation is completed. These are in addition to 
what Logan is doing. 


In Conclusion: 

We owe it to the traveling public to do everything in our capacity to ensure their 
safety. We have the technology today as a nation to peacefully and responsibly make 
a difference in the war against terror and to restore the publics trust in the travel 
process without a cost to the privacy of the honest majority. I see no legitimate ob- 
jection why we should not do it. 

Chairperson Feinstein. Thanks very much, Dr. Atick. 

Mr. Huddart? 

STATEMENT OF MARTIN HUDDART, GENERAL MANAGER, REC- 
OGNITION SYSTEMS, INC., INGERSOLL-RAND CO., CAMP- 
BELL, CALIFORNIA 

Mr. Huddart. Thank you, Madam Chairwoman and Senator Kyi. 

My name is Martin Huddart. I am the general manager of Rec- 
ognition Systems. We were the first commercial biometric company 
in the world. We were found in 1986, based in Silicon Valley, Cali- 
fornia. We are now a division of Ingersoll-Rand, a Fortune 200, $9 
billion company which has a significance presence in security and 
safety through a variety of products and services, including the 
Schlage Lock Company that is present in millions of households 
throughout the world. 

Recognition Systems is certainly a tried and tested technology 
and my testimony today will hopefully demonstrate that. We have 
over 60,000 systems in 80 countries throughout the world and 
there are literally millions of people enrolled in our systems. 
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Hand geometry is the science of looking at the size and shape of 
your hand. We are looking at 31,000 datapoints making 90 unique 
measurements. The interesting part about this particular tech- 
nology, it is very fast, as we will show in a demonstration later. It 
is also very reliable in a coupled of environments that I think re- 
late directly to many of the environments we have talked about 
today, such as airports, which is a high volume application where 
you need to process large numbers of people, say at an immigration 
or airport access control points. And it is very robust for difficult 
environments — light, heat. We have outdoor units which operate at 
subzero temperatures. 

As we have participated and listened to the on-going debate 
about using technology there is a continuum that starts at experi- 
mentation and goes through implementation. It is our view we are 
very much on the implementation end of the spectrum. The reason 
is that this technology, many technologies are available today and 
have already been implemented by many private sector companies 
but also many government agencies, and that is what I would like 
to focus on. I want to talk about what has already been done, as 
I think that is a way to look at what can be done further, in two 
key areas that were mentioned in earlier testimony. One is immi- 
gration, identity verification, which could also include passenger 
verification, and then also access control to critical facilities in our 
national infrastructure, including airports as a key example. 

So let us start out with immigration identity verification. One of 
the tasks here is we have a very large haystack to look through. 
Our technology is already being used in programs which prescreen 
travelers through immigration points, which allow the immigration 
officials to focus on the higher-risk passengers, and that is 
leveraging our resources more effectively. 

Inspass is a system that is already using biometrics for immigra- 
tion in the United States and Canada today and it has been doing 
so for the past seven years. Over 50,000 frequent travelers to the 
U.S. are enrolled in this program where they can bypass often the 
long immigration lines at nine North American airports, including 
Dulles, San Francisco, JFJ, Newark. Passengers approach this 
kiosk that you can see on the screen. They use a card, the card is 
used to claim who they are, and then the biometric, in this case 
hand geometry, is used to verify that they are actually who they 
claim to be, and this allows expedited arrivals back into the United 
States. 

A similar system is in place today at Ben Gurion Airport in Tel 
Aviv, Israel, one of the world’s most security-conscious airports. 
Twenty-one kiosks process 50,000 passengers per month today. 
This is not a trial; it is in process today. The line to get through 
immigration can go from 60 minutes down to 20 seconds by 
verifying the identity of those frequent travelers back to Israel. 
This system will be shortly expanded to the Israel-Palestinian bor- 
der where both hand geometry and face recognition with Visionics 
is being used at the land border, also. 

The second area that biometric technology can be used in the 
war against terrorism is employee identity verification. We have 
talked a lot about the fact that cards are not people and biometrics 
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is a way to go beyond the security that simple card technologies 
give us today. 

The nuclear industry were the first industry to widely adopt bio- 
metrics. Over 90 percent of the nation’s nuclear facilities use hand 
geometry readers and recognition systems to validate the identity 
of the employees going through the facilities and it has been in- 
stalled for over a decade at many facilities, supported by the De- 
partment of Energy. 

Airports. We have talked about San Francisco airport is the only 
fully deployed biometric system in the country where all airport op- 
erations doors are protected with biometrics, with over 30,000 em- 
ployees using the system today. It has been in place since 1991. 

FAA regulations currently specify that only authorized people are 
allowed access to the operations areas and San Francisco has been 
very aggressive in interpreting that to mean badges are not people; 
people are people, and using biometrics validates that. This was in- 
stalled during your tenure as mayor of San Francisco, Senator, and 
you are welcome to come visit and you may have seen the readers 
at San Francisco as you have passed through there many times. 

Seaports is another area of risk for national infrastructure. Rot- 
terdam, the world’s largest port and the gateway to European com- 
merce, uses hand recognition technology to identify and validate 
the truck drivers who come into the petrochemical storage areas, 
a key area that you want to make sure only authorized people are 
allowed access to. 

Many, many government facilities have already adopted this 
technology, including the Pentagon, the State Department, DARPA, 
several post offices. Federal Reserve Bank, which you see in the 
picture. Many American embassies, which have also talked about 
today, use this technology to protect their facilities, and many state 
prisons systems do the same. 

Private industry has been a long adopter also of this technology. 
For example, the NASDAQ uses this technology to protect their 
service from unauthorized access, to protect the trading. Many re- 
search labs, banks, office buildings, colleges, schools, even day care 
centers use this technology to make sure only authorized parents 
pick up the children. 

So I will leave you with the words, this is not a test. Usually in 
a security environment that is not a good statement but this is ac- 
tually good news in that we have a significant library of identity 
verification solutions already in place and those solutions can be 
copied and pasted to many different areas of risk within our na- 
tion. 

And if I can do a very quick demonstration that lasts 30 seconds? 

Chairperson Feinstein. Fine. 

Mr. Huddart. If I can ask Gordon to help me here, I will come 
around so you can see. This is an example of the smartcard, which 
I enrolled Gordon earlier with. It is a contactless smartcard that 
is a biometric template. You can see by the green light at the top 
of the unit that his identity was verified. If I get possession of Gor- 
don’s smartcard and I try to use it for unauthorized access, if you 
watch the top of the panel you will see the red light and I was re- 
jected and we keep a record of that event having taken place. 

I would like to present you with your own card. 
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[The prepared statement of Mr. Huddart follows:] 

Statement of Martin Huddart, General Manager, Recognition Systems, Inc., 

Campbell, California 

Madam Chairwoman and members of the Senate Subcommittee on Technology, 
Terrorism and Government Information: 

Good morning. I am Martin Huddart, General Manager of Recognition Systems, 
Inc. (RSI) based in Campbell, California, in the heart of Silicon Valley. 

We are a pioneer in the application of biometric systems. Our primary technology 
is Hand Geometry. RSI’s HandReaders have been installed in high security environ- 
ments around the United States and worldwide since 1985. Today, there are more 
than 60,000 HandReader systems installed in 80 countries around the world, read- 
ing millions of hands every day. We are the industry leader in providing biometric 
technology solutions that protect important U.S. economic, energy, military, and 
transportation infrastructure. 

RSI is a division of Ingersoll-Rand Company (IR), a Fortune 200 diversified indus- 
trial manufacturer and a world leader in security and safety. RSI and IR provide 
integrated security solutions — including hardware, biometrics and electronic tech- 
nologies, software applications, maintenance and consulting services to government, 
military, commercial and industrial customers. 

RSI’s technology solutions have been installed in high-security, high volume ac- 
cess control environments for more than a decade. These include over 90 percent 
of the nation’s nuclear power plants, as well as in leading scientific laboratories. 
Federal prisons, commercial airports, U.S. military bases, seaport cargo facilities, 
hospitals, universities, government buildings, industrial plants and commercial of- 
fice buildings. Our technology is even used at day care centers to protect unauthor- 
ized persons from having access to the children. 

In the wake of the terrorist attacks on September 11, one task is certain: we must 
significantly increase and upgrade security not only at U.S. commercial airports, but 
at other critical national infrastructure that could potentially be targeted by terror- 
ists. The President’s establishment of the Office of Homeland Security is an impor- 
tant initiative to better coordinate the efforts of more than 40 Federal agencies. 
Hearings like this — and others that RSI has participated in the past month — can 
help legislators better understand existing and new technologies, enabling you to 
make critical policy decisions that will better protect America’s important infra- 
structure from future terrorist attacks. 

Biometric systems lie at the core of technologies that can provide heightened secu- 
rity at a variety of infrastructure installations. Biometrics is the science of using 
physical characteristics to identify an individual. Modern biometric systems were 
developed in the 1970s. Early commercial products were expensive and therefore 
limited to very high security applications, such as nuclear facilities and laboratories. 
In recent years, developments in microprocessors and advanced imaging electronics 
have greatly reduced the cost and increased the accuracy of biometric devices. These 
developments have made biometrics increasingly common in commercial applica- 
tions for access control, and even accurate personnel time and attendance moni- 
toring. 

RSI’s HandReader was designed to be used in high-volume environments, where 
the identity of hundreds or even thousands of individuals must be accurately 
verified in a quick and efficient manner. These devices ensure that only authorized 
individuals gain access to specific places. This technology has been engineered to 
work reliably for a wide variety of users in difficult operating environments, includ- 
ing even sub-zero outdoor applications. The accuracy, reliability, durability and suc- 
cessful track record of biometric hand reading technology is unparalleled in the in- 
dustry. 

Members of Congress and Federal and local authorities have been inundated with 
proposals for new technologies since September 11. This includes many different bio- 
metric systems, including hand, iris, fingerprint, facial and voice recognition. While 
there is no disagreement that technology has a vital role in finding new security 
solutions for U.S. infrastructure, we must understand that this is not the time to 
experiment with new and unproven systems. Only those technologies and products 
that have already been proven in high-security environments, and which have an 
established reputation for performance, should be in the forefront of our decision- 
making processes in the weeks and months ahead. 

To this end, one fact is well-established and should be clear: Of all the biometric 
systems currently in use, hand readers are the technology that today best meets the 
essential tests of performance and reliability in high-security environments. This is 
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a mature system that can be put in place quickly to meet a variety of security appli- 
cations. That is what differentiates this technology from others. 

This technology can be used for different types of security applications. One is 
preventing unauthorized employees from gaining access to specific areas and assets. 
Another is to quickly and efficiently identify low-risk users, such as pre-screened 
airport passengers, so that security personnel can focus on a much smaller category 
of people — high-risk passengers. RSI HandReaders can reduce the size of the hay- 
stack, so we have better chance of finding the needle in it. 

RSI has worked with several U.S. Government agencies over many years to incor- 
porate biometric systems into their security infrastructure. We have worked with 
the Immigration and Naturalization Service, U.S. Department of Energy, General 
Services Administration, Federal Bureau of Prisons, Drug Enforcement Agency, The 
Federal Reserve Board, U.S. Department of State, Federal Bureau of Investigation 
and most branches of the U.S. armed forces. 

The Department of Energy has long realized the weaknesses of conventional card 
based access control systems at nuclear facilities. Concerned with stolen or forged 
access cards, 90% of the nation’s nuclear facilities installed HandReaders at sen- 
sitive access points during the 1990s. These installations are not new, they are not 
a test, and they work reliably. 

Given the new security concerns created by the terrorist attacks of September 11, 
I would propose that this proven model of security needs to be applied to other crit- 
ical elements of our national infrastructure such as airports, power plants, chemical 
plants, port facilities, and transportation control facilities. There is a critical role for 
Congress and Federal regulatory agencies to play in mandating that new security 
procedures and technologies be put in place. 

Nowhere is there a more immediate security challenge to address than that of 
U.S. commercial airports. Already, this Congress and the Department of Transpor- 
tation have proposed several new initiatives. Some of these will take time to imple- 
ment. One example of how we can very quickly improve airport security would be 
for Congress to improve existing Federal regulations to reflect the new security en- 
vironment we all face. For example, the Federal Aviation Administration’s directive 
FAR 107.14a mandates that only authorized people are allowed access to flight oper- 
ations at commercial airports. Most airport authorities used card-based access sys- 
tems to implement this mandate. These systems are inadequate because they can 
only accurately identify cards, not people. Only a biometric system that reads an 
individual’s hand to provide positive identification of that person can do this. 

One U.S. airport which has correctly interpreted the intent of this FAA mandate 
is San Francisco International Airport (SFO). At SFO, all 30,000 airport employees 
use RSI HandReaders throughout the entire facility. This is not a pilot program or 
a demonstration project; it is an integral component of the airport’s security infra- 
structure. It has been in place for more than a decade. This system was installed 
during the Chairwoman’s tenure as Mayor of San Francisco. I would urge other 
members of the Subcommittee and the Congress to examine how this technology has 
been used at SFO and to consider utilizing it throughout our national air transpor- 
tation system. 

In addition, while we applaud the Federal government’s interest in exploring new 
security technologies through “pilot” projects, we must understand that these will 
take time to identify, test and implement. Time is our enemy. Therefore, we can ill 
afford to delay bringing the added security benefits of proven biometric applications 
while we investigate potential future enhancements. 

At the top of any national priority list must be the desire to improve security and 
procedures at U.S. airports, seaports, land border crossings and high-profile govern- 
ment buildings. In each of these areas, hand geometry biometrics is already in use 
in some of the world’s most sensitive security environments: 

RSI HandReaders are used not only at San Francisco International Airport 
and several other leading U.S. airports, but also at Ben Gurion Inter- 
national Airport in Tel Aviv. Passengers returning to Israel insert a simple 
credit card into a biometric kiosk as a means of presenting their identity. 

This identity is verified through the placement of their hand in the kiosk. 
Successful processing can be achieved in 15 seconds, much faster than the 
hour it can take to clear the regular immigration lines. Similar biometric 
immigration kiosks have been in place for the past 7 years at 9 North 
American airports including Dulles, JFK, Newark and Dallas airports as 
part of the INS sponsored INSPASS program. With over 60,000 frequent 
travelers enrolled in the program, there are 23,000 pre-screened passengers 
per month using this immigration process. 

A voluntary frequent traveler program is very powerful because it allows 
officials to focus resources on higher risk individuals and allows pre- 
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screened passenger travelers to proceed quickly through airport security. I 
will demonstrate how a proximity smart card loaded with a biometric tem- 
plate can be used to validate a passenger’s identity in such a program. Also, 
our vision is that biometric screening processes can be applied to the check 
in and security check points of an airport, to make sure that the person 
who checked in is the same one who entered the plane. 

In addition to the airport, the Israeli border crossing application will be ex- 
tended in 2002 to the provide security at one of the most high-profile land 
border crossings in the world — the Israeli-Palestinian border crossed by 
more than 50,000 individuals daily. Again, biometric solutions will help 
manage visa and immigration procedures by reducing the risk of identity 
fraud. 

Our technology solutions are used at the port facility in Rotterdam, Nether- 
lands, the world’s largest seaport facility and the primary sea transport 
gateway to the European continent to verify the identity of truck drivers 
accessing petrochemical storage areas. 

U.S. Federal agencies use RSI’s HandReaders at sensitive government in- 
stallations including the Pentagon, U.S. military bases, the State Depart- 
ment, the NSA, DARPA, the US Postal Service the Federal Reserve Bank 
and American embassies abroad. 

HandReaders protect access to hundreds of critical computer server facili- 
ties including the computers which run the Nasdaq stock exchange. 

During the 1996 Olympic games in Atlanta, HandReaders reliably secured 
access to the Olympic village so that only athletes and authorized personnel 
entered the secured area. 

As our nation moves forward following the tragic events of September 11, the 
overriding security issue will be to better manage identity verification and access 
control in a variety of high-volume environments. While machines can never fully 
replace highly trained and vigilant officials, a biometric hand reader will not get 
tired at the end of the shift, it will never take a day off, it won’t “loan” its access 
code to cousins, friends or co-workers, and it won’t accept a forged identity card. 
When integrated with other security technologies and procedures, hand geometry 
readers can significantly cut down the risk of unauthorized individuals gaining ac- 
cess to places and assets where they can cause damage. 

I’d like to leave this Subcommittee with a piece of good news. The good news is 
that we can copy from a large library of proven identity verification solutions, then 
cost effectively paste these into the highest risk applications of our choice. We urge 
this Subcommittee, the Congress and Federal agencies to support the adoption of 

g rocesses and technologies which will validate the identity of those accessing our 
orders, airports, ports and other critical national assets. 

Thank you. 

Chairperson Feinstein. Thank you. Thank you very much, Mr. 
Huddart. 

Mr. Haddock? 

STATEMENT OF RICHARD M. HADDOCK, PRESIDENT, DREXLER 
TECHNOLOGY CORP., MOUNTAIN VIEW, CA 

Mr. Haddock. Thank you very much. I thank Senators Feinstein 
and Kyi for having me here today. I only discovered yesterday at 
noon that I was able to come so my remarks are perhaps briefer. 

One thing I would like to point out is that Drexler Technology 
Corporation has been the manufacturer of optimal memory cards in 
Silicon Valley for over 10 years and has been the supplier to the 
INS for both the INS’s green card, permanent resident card, as 
well as the Department of State’s border crosser card since 1997 
and the supplier to the U.S. Army since about 1991. 

The main feature of optimal memory cards is it how very large 
capacity. It has about 500 times more capacity than any other type 
of data storage card used in a wild-type environment and coupled 
with that, it is a very secure medium that allows data to be written 
to an area of the card only once, meaning that if you put a biomet- 
ric on, say, track 1,000, you know that no one else can ever change 
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that. This is a key feature that caused the INS to adopt the card, 
to upgrade from their previous pink paper card, and essentially 
stopped all the counterfeiting and fraud that they had from that 
purpose. 

But these cards contain biometrics. They contain the digitized 
color photograph of the card carrier. They contain what the INS 
views as an FBI-quality high resolution greyscale fingerprint. From 
that fingerprint can be extracted minutia from any formats because 
there are a number of proprietary minutia formats in the industry 
and the INS wanted to have a format that crossed industry bound- 
aries and therefore, they wanted a high resolution image that could 
be used anywhere by anyone if they so authorized it. So it is a 
flexible biometric in that form. They have a digitized signature. 

And in the Department of State version, which was implemented 
a year later, they also have two different fingerprint minutia tem- 
plates. 

To date there are about 10 million of these two cards in circula- 
tion in the United States held by permanent residents and Mexican 
citizens entering the United States and as such, it represents the 
highest security card in the country, the only card containing that 
type of biometrics in the United States and certainly one of the 
most secure cards in the world in our opinion, as well as at INS 
Forensics Department. 

Part of the thing that I would like to testify here today at your 
panel is that we have been making these cards for over 10 years 
and there has been a great deal of interest in putting biometrics 
on the cards because of the high data capacity. I am probably the 
only one here that has business dealings with everyone on this 
panel. I have teamed on subcontracts with some; I have been re- 
sellers to others. Almost all of these technologies have been imple- 
mented successfully with optical memory cards so for more of an 
end-user point of view, we have a look at all of the biometrics that 
you are discussing here today. And having been involved in looking 
at biometrics for the past 10 years, we feel that we agree with your 
view of the fragmentation of the industry. All of these biometric de- 
vices have strengths and weaknesses and we have come to the 
opinion that the best thing that can be done is to put more than 
one biometric on a card. I do not think you can choose the right 
one. I think that it takes more than one and the type of biometric 
that should be applied is application-specific. I think the FBI testi- 
mony pointed that out earlier. 

I think starting off with an FBI-cleared personal clearance so you 
know that you have the right person I think is the right basis of 
issuing a card but after that you can add any types of biometrics 
you want. Essentially with the data capacity available in our cards 
you can put everybody’s biometrics on this card today. You can 
verify face, hand, fingerprint, any type of biometrics, and use them 
randomly and selectively. 

This is a key factor because if you choose only one biometric, peo- 
ple will focus on that and there can be ways to break any given 
biometric if that becomes the standard for the country. So we feel 
it is much better to include multiple biometrics and be able to 
choose them as you need them and randomly, perhaps. Sometimes 
you use a fingerprint; sometimes a hand. 
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Additionally, you want to be able to upgrade this. The cards you 
issue need to be available for a long period of time. The technology 
will change; the templates will change. You want to be able to add 
that new technology to the card or adapt it without having to re- 
issue cards. And having a secure medium to build on, you have the 
ability to do that. 

In my testimony there are a number of references to programs 
that we have done with many of these vendors and we found the 
advantage of multiple biometrics in actual practice. So what we 
would like to recommend, one thought to leave you with is what- 
ever the solution is, that you should consider multiple biometrics 
and also allowing those biometrics to be used selectively and per- 
haps even randomly, given different types of security concerns at 
different points of entry, and so forth. 

So that is the substance of what I would like to say today and 
I am available for any questions you may have. 

[The prepared statement of Mr. Haddock follows:] 

Statement of Richard Haddock, President, Drexler Technology 
Corporation, Mountain View, California 

Madam Chairperson, distinguished members of the Senate Subcommittee on 
Technology, Terrorism, and Government Information, my fellow panelists: 

Thank you for the opportunity to share my professional opinion with you regard- 
ing the application of biometric identifiers in our global war on terrorism. My name 
is Richard Haddock. I am President and Chief Operating Officer of Drexler Tech- 
nology Corporation, a public company located in Mountain View, California, and 
traded on the NASDAQ as DRXR. We market our optical memory card products 
through our subsidiary, LaserCard Systems Corporation. 

I have personally been involved with the invention and commercialization of high- 
ly secure optical memory cards for more than 20 years. These unique cards — called 
LASERCARDS® — have come to be known as the “world’s most counterfeit resistant” 
identification cards. 

This technology was invented here in the United States by Drexler Technology, 
an American company. Drexler manufactures optical cards and systems for sale 
worldwide from our facilities in Silicon Valley. I am here today because my company 
has extensive experience utilizing various biometric technologies as part of the 
unique security design of an optical card identification system. 

Each of the technologies discussed by my fellow panel members could be and, in 
some cases, already are being used in secure optical memory card identification sys- 
tems. In fact, ALL of the technologies described here today, plus others currently 
available, could be combined on one card to facilitate various levels of secure author- 
ization and multiple site interfaces without the need for a central database of per- 
sonal information or required on-line access ever 3 rwhere identification is needed. 

I would like to organize my remarks into three parts — 

1. How to best use biometric identifiers for personal identification; 

2. What a secure identification card is; 

3. Field experience with biometrics on secure ID cards 

How TO Best Use Biometric Identifiers for Personal Identification. 

It is important at this point to recognize that I am a technologist and not someone 
who makes public policy. However, as an American, I can also see both sides of the 
long-standing debate over personal privacy as it relates to recent discussions in the 
press about national databases and even a national ID card. 

I enjoy my personal freedoms but I am also greatly disturbed by the ease with 
which innocent people can be horribly impacted by persons having criminal intent — 
whether it be by gaining unauthorized access to our Nation and its services or by 
simply stealing one person’s identity. 

This must stop. And, we have the technology to do so today. 

From my perspective in the Silicon Valley, it seems that the primary focus of the 
current national identification debate is (1) whether or not we need a national data- 
base containing each citizen’s personal information; and (2) whether the American 
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public would feel comfortable having to show an identification card to receive serv- 
ices. 

From my perspective, there is no question that there needs to be some form of 
national database or, at the very least, a sharing of information between key data- 
bases to ensure that threats are identified and cannot hide. Without such informa- 
tion, how could we ever expect to issue valid personal identification of any type? 

The issuance of personal identification, such as drivers licenses, must be based 
upon an assurance that the persons being provided such documents are who they 
say they are and, further, that they are qualified to receive specific services and are 
not perceived to be a threat to those services or for any other services for which 
the personal identification might be used. The only way to do this is to check their 
applications against databases deemed appropriate by the issuing authority and 
positively identify them each time they request controlled services, such as air 
transportation. However, those databases do not need and should not contain per- 
sonal information about our citizens. 

The requirement that I show personal identification to receive services has never 
concerned me, nor does it appear to concern the majority of Americans. 

In addition, I must have shown my drivers license at least a dozen times just get- 
ting here to meet with you today. It seems that everyone wants to see a “photo ID” 
these days. Unfortunately, I would be very surprised if anyone who inspected my 
drivers license could really tell if it was a valid ID and that I am really who I say 
I am. 

That’s where biometric identifiers come in. 

As you might expect, my primary concern is the security of the personal identi- 
fication document, itself — how certain can we be that the document is valid and that 
the person presenting it is in fact the person authorized by it? This is true whether 
the document is a passport, visa, pilot’s license, drivers license, or frequent flyer 
card. 

We can no longer permit any identification document, like a drivers license, to be 
used for higher level authorizations, like airline passenger check-in, without first 
considering the security level of the issuance criteria and the security of the docu- 
ment, itself. 

It is this fundamental fact that tends to lead us all into the debate about central 
databases and national identification. In my opinion, such a debate is not necessary. 

One central identification database or on-line identification card will not solve our 
Nation’s security problem — it is far too complex an issue. Such a solution would 
merely create more problems by requiring that extraordinary amounts of personal 
information must be kept in central databases for even the most basic level of serv- 
ice request. 

Even beyond privacy concerns is the technical reality that highly centralized, on- 
line systems are subject to overload, system-related failures, hacking, and cyber-ter- 
rorism. Creating a central database, national identification system that is always 
online could provide a single point of failure for our entire society if our enemies 
ever targeted it. 


What a Secure Identification Card Is. 

No matter whether it is a drivers license or frequent flyer card, a secure identi- 
fication card is a personal identification document, which verifies that a person is 
who he says he is, is not a threat, and has authorization for the requested service 
or activity. 

As I have said, authorization for the requested service or activity must be deter- 
mined at application and re-validated periodically during the life of that authoriza- 
tion. This requires some form of national database screening at a level consistent 
with the security needs of the authorization. Such checking can also be used to 
verify that the person is not a potential threat. 

Verifying that the person is really who he says he is requires three things: (1) 
a secure identification card that cannot be easily counterfeited; (2) a biometric 
means to link the person to that card with certainty; and (3) a secure automated 
interface to verify that the person and card links are valid. 

To avoid privacy concerns, the databases used during application should only be 
those determined to be relevant to the requested services. All other personal data, 
including biometric identifiers, should he retained by the individual on his or her 
secure identification card. 

How would this work? 

When an individual requests specific services or benefits (for example, an airline 
frequent flyer card to minimize check-in delays), an application would be submitted, 
reviewed, and approved. Next, a secure card would be issued containing multiple bi- 
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ometric identifiers, which can be read and verified by automatic readers at access 
or authorization points. 

When the cardholder requests specific services (such as e-ticket check-in at an air- 
port kiosk), the cardholder’s identity can be quickly run against an on-line threat 
database without any personal information being transmitted from the card. Moving 
through screening stations, such as carry-on inspection and gate check-in at an air- 
port, can be accomplished with off-line access control readers. The cardholder would 
be matched against a selected biometric or combination of biometrics found on his 
or her card (such as a fingerprint, iris scan, face, hand, or finger geometry). The 
time required to make such a match, linking the cardholder to the card, is less than 
5 seconds. 

Please note that I suggested a “selected biometric or combination of biometrics” 
in this brief scenario. 

Biometric identifiers are not perfect. Each has a margin for error. To avoid rejec- 
tion as well as the possibility that someone might try to defeat a one-biometric sys- 
tem, multiple biometric identifiers are highly recommended. 

We have also found that not all locations will necessarily want to use the same 
method of biometric identification. In fact, our experience indicates that there is 
considerable interest in using a random combination of biometrics so that the card- 
holder will not know what biometric is being evaluated at any given time. This is 
definitely possible with current technology. 

Field Experiences with Biometrics and Secure ID Cards 

The product we manufacture, the LASERCARD® optical memory card, has the 
highest memory capacity of any standard ISO credit card format. This capacity is 
about 200 — 500 times more than the highest smart “IC” cards on the market today. 

More importantly, we have had this high capacity card in the market for more 
than a decade, which has allowed our users to implement any and all biometric so- 
lutions offered in the market for many years, including all you have heard about 
here today. 

It is due to the optical card’s ability to store multiple biometric files and templates 
that almost all industry biometric devices have been linked into optical cards, and 
in most cases, more than one type of biometric data has been stored. The perma- 
nent, non-erasable laser recorded media makes optical cards the natural vehicle for 
secure, biometric based ID cards. 

Examples of these applications include, most significantly, the US Immigration 
and Naturalization Service’s Permanent Resident Card (the “Green Card”), which 
contains about 80,000 bytes of biometric information. Biometric files are stored in 
an INS secure partition on the card, accessible only through the use of INS con- 
trolled secure field readers. Included in this data zone are: 

High quality color image of the card holder (as printed on the card surface); 

FBI quality gray scale fingerprint image of the card holder; and 
Digitized image of the card holders signature 

Additionally, the US Department of States’ “LaserVisa” border crossing card for 
Mexican citizens entering the U.S. has the same technology used on it, but adds 
even more biometric information to the card by the addition of two fingerprint minu- 
tiae files on the card to supplement the full image files stored. 

Together, with more than 10 million of such cards in circulation within the US 
today, these cards represent the largest high security, biometrics-based, ID card pro- 
gram in US history. It is estimated that by the end of next year, this total will rise 
to 20 million cardholders. 

Many smaller programs have been launched using optical cards and biometrics in 
the past 10 years, and these programs give a good insight into what is necessary 
to achieve a secure and cost-effective ID card system. 

We have teamed with Unisys to design a border entry system using both Iris Scan 
and Digital Persona fingerprint systems. 

We have worked in Hong Kong on the implementation of a pilot immigration con- 
trol system there using both Identix fingerprint scanners and Recognition Systems 
Hand Geometry Systems. 

We have implemented Identix fingerprint scanners for a banking card in the 
Czech Republic, and have supplied hand geometry systems to our resellers world- 
wide. 

We have implemented signature verification systems using Checkmate systems, 
and those from CIC. Our cards have been used with voice recognition and face rec- 
ognition, as well as two finger “Digi-Two” finger geometry biometric systems. 

In short, we believe that we have the most extensive biometric based experience 
of any card supplier, since we have always had the ability to store and implement 
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any and all biometrics from a single card. No database connection is required for 
our totally off-line verification system approach to these biometric systems. 

Based on this long-term experience with all forms of biometric devices, we have 
developed our own view of the best approach to a biometric ID system. The key ele- 
ments of such a system are: 

Implement more than one type of biometric; 

Allow room to add new biometrics seamlessly; 

Assure off-line verification ability; 

Provide for selection of appropriate biometric based on application require- 
ments; and 

Assure integrity of the biometric files from issuer to user. 

Explaining in more detail: 

IMPLEMENT MORE THAN ONE TYPE OF BIOMETRIC: 

There is no perfect biometric system. All systems have their strengths, weak- 
nesses, and vulnerabilities. The selection of a single biometric for any large-scale 
system invites a concerted effort to defeat any given biometric, which will be done. 
This was the experience in the Hong Kong pilot, where both fingerprint and hand 
geometry systems were targeted by the test system, and both were shown to have 
vulnerabilities. The same is true for Iris scan and face recognition systems. Exam- 
ples of failure modes include false fingertips, rubber hand molds, glass eyes, contact 
lens, and actors face make-up techniques. 

Adding to the complexity is the need to accommodate the disabled and handi- 
capped in any public access system. Considerations include: 

IrisScan system needs to accommodate the height ranges from children, 
wheelchairs, and basketball players, blind eye without eyes or glass eyes. 
Hand Geometry system needs to work in hand size ranges from small chil- 
dren and Asian women’s hands through football players, plus the fact that 
not all people have right hands. Sanitation concerns must be addressed as 
well, given concern over germs and disease. 

Fingerprint systems need to address the same sanitation concerns as Hand 
Geometry, plus the ease of false fingertips and other substitution methods. 
Proprietary template algorithms and changing standards need to be ad- 
dressed as well. The fact that many older people and some from the manual 
labor ranks have essentially non-existent or non-usable fingerprints needs 
to be accommodated as well. The inclusion of all ten fingerprint files and 
templates onto the card would help to eliminate this problem. 

Face recognition will not be acceptable to many in the Muslim religion and 
is subject to many ACLU concerns. A best “one-to-one” match of the highest 
reliability requires several views to be stored, increasing template file sixes 
to the range of 30,000 bytes. While this is no problem when stored on an 
optical memory card, it is beyond the range of any other ID card to deal 
with. 

Signature, voice, fingers, retina, and other biometrics all have similar 
weaknesses 

In summary, it is our opinion that more than one biometric should be imple- 
mented on any secure ID card system, and that the selection of the biometric to be 
used by any given application at any given time not be known to the cardholder 
in advance. 

This “redundant and random” biometric approach will greatly enhance the overall 
system security, reduce single vendor dependence, and allow tailoring the system to 
accommodate all citizens, regardless of their race, religion, age, handicap status, or 
other limitations relative to a given biometric approach. 

It is for the above reasons we recommend the use of two or more biometric ele- 
ments in any secure ID card system. 

ALLOW ROOM TO ADD NEW BIOMETRICS SEAMLESSLY: 

Any ID card system storing biometrics in a secure form will have a significant 
card issuing cost, which means card life and updatability are important. The INS 
and Department of State optical cards have a 10-year expiration period, more than 
5 years beyond any smart “IC” card warranty. This is a long time, and technology 
will change. The card should be capable of being updated and upgraded in this pe- 
riod, as new biometrics, software, and application requirements come along. This 
means one of two things — either (1) you have an erasable, changeable media, like 
a smart “IC” chip card, and live with the risk of changeable and erasable media, 
or (2) use media<br>having enough updateable memory, such as the permanent re- 
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cording media on the optical card, to provide an audit trail to the previous informa- 
tion. This was a key feature for both the INS and the State Department in the selec- 
tion of the optical card, since it allows them to update the card without the need 
to re-issue it. 


ASSURE OFF-LINE VERIFICATION ABILITY: 

Any ID card system should be capable of complete, secure verification of the card- 
holder to the card without any dependence on a on-line database, although it may 
be present. The failure of many online systems to be effective, including the INS 
“INSPASS” program, is their total dependence on a nationwide 100% uptime, on- 
line database to verify the cardholder ID and allow entry. Most INSPASS system 
downtime is due to network and communication failures and has constricted the 
system implementation to less than 100,000 people across the many years the pro- 
gram has been in place. 

Having the ability to completely verify the cardholder off-line, using local black- 
lists in each terminal, would eliminate this problem. Additionally, the off-line capa- 
bility allows the implementation of mobile and hand-held reader terminals, which 
can greatly expand the value and usefulness of any ID card system. 

PROVIDE FOR SELECTION OF APPROPRIATE BIOMETRIC BASED ON APPLICATION 

REQUIREMENTS: 

Having multiple biometrics on one card means you have the ability to select the 
most appropriate type for a given situation or application. Using Hand Geometry 
on doors, face recognition in terminal access points. Iris scan at high security zones, 
and fingerprints for ticket check in, could all be accomplished seamlessly with one 
card, optimizing each technology for a given area. The added benefit of this is that 
the use of multiple biometrics throughout a given system greatly enhances the over- 
all system security, since breaching one biometric does not cause a total system fail- 
ure. If such a breach is recognized, the system applications could easily be re-pro- 
grammed to select another card biometric, without the need to re-issue cards. Given 
the growth of technology and biometrics in general, this is a very important consid- 
eration of any new system design. 

ASSURE INTEGRITY OF THE BIOMETRIC FILES FROM ISSUER TO USER: 

In any system design using biometrics for ID, it is essential to ensure that the 
biometric file added to the card at the time of issuance cannot be tampered with, 
erased, or substituted. Without such safeguards in place, there is no security, since 
anyone can obtain a similar biometric system, create their own biometric template 
files, and substitute them into the valid ID card. All card systems attempt to mini- 
mize this risk, however, only the non-erasable optical memory card can intrinsically 
eliminate this concern, because the laser writing process, like punching holes in 
paper, is physically impossible to erase or overwrite. 

All Smart “IC” chip cards hold such critical information in their “EEPROM” mem- 
ory, meaning “Electrically Erasable Programmable Read Only Memory”, which 
means no such assurance can be had. No other card data storage technology, from 
barcodes to magnetic stripes, is appropriate for secure biometric information that 
must be updated, yet secure. 


SUMMARY 

In closing, I would like to point out that the INS and Department of State 
LaserVisa secure ID cards represent the most advanced biometric card systems in 
the US, and perhaps the world. The cards have a minimum of three biometric files 
each, and are vendor independent in their ability to be verified. The card’s storage 
of up to 80,000 bytes of biometric data is ten times more biometric information than 
available on any other type of ID card, and yet uses less than 20% of the total avail- 
able card memory. 

Other governments are following the lead of the INS. The Italian government has 
started issuing optical memory-based ID cards as the basis of their new National 
ID card, and tenders from many other countries are specifying the use of optical 
memory upon which to base their biometrically secured ID card systems. 

Use biometrics for any ID card system. And for full security, flexibility, and long- 
term system life, the use of more than one biometric on the card is highly rec- 
ommended. 

I will be pleased to answer any questions you may have. 

Chairperson Feinstein. Thank you very much, Mr. Haddock. 
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Miss Lau? 

STATEMENT OF JOANNA LAU, CHAIRMAN AND CEO, LAU 
TECHNOLOGIES, LITTLETOWN, MASSACHUSETTS 

Ms. Lau. First, let me thank you for giving us the opportunity 
to present here. I want to say that it is unfortunate that it often 
takes a crisis to create an opportunity to make change. About 11 
years ago my company was involved with Desert Storm and that 
certainly brought us a tremendous opportunity during that crisis 
and also gave us the opportunity to learn about the defense and 
learn more about technologies, how it could improve our nation. 

Well, we are now here at an urgency to really make change be- 
cause even though we win the war, we are going to create more 
terrorists around us, so it is important we make change at our bor- 
ders, as well as what is going on here — not only terrorism, also the 
most wanted list that could be endangering us domestically, as 
well. 

That being said, let me say that Dr. Atick basically touched on 
a lot of the basics regarding facial recognitions. I am here to also 
talk about facial recognition so I am not going to bore you with all 
the technical data. Let me go straight to the success story. 

Again I think a lot of my colleagues have said this is not a test. 
This is reality. We have spent a lot of money among all of us in 
this technology to try to improve the nation, so the timing is just 
right that we have now come here to answer the call. So let me put 
this to you, some of the success stories, some of the events, some 
of the installations. And, of course, in my case I will be just talking 
facial recognition. 

In Pinellas County, Florida this year we were funded by the Con- 
gress for the sheriffs office to implement facial recognition to assist 
the jail operations and criminal investigations. Within a couple of 
weeks we found over hundreds of individuals who are duplicates, 
with false IDs and what-not, in a total of 350,000 images. 

As my colleague pointed out, this is real data. This individual in 
Pinellas County, it pulls up his face. As you can tell, he has many 
different looks. He lost weight, he shaved his hair, shaved his 
beard, and who knows who else he has done to himself but more 
importantly, he has different identities, he has different names, dif- 
ferent Social Security numbers. So we were able to run that and 
pull him out. As you can tell, he showed up about 15 times. 

This is also a system that is currently being piloted at the De- 
partment of State to also scrub the database to reduce some of the 
lists that are not as big as we thought they were. 

In the casinos, of course, the casinos has used it for surveillance. 
Over 100 casinos worldwide have used this facial recognition to 
scan cheaters, card-counters, and what-not as they walk into the 
casinos. It became a deterrence for them. They now know to stay 
away. We have actually found quite a number of cheats at Trump 
Tower in Atlantic City. It is a fascinating place to go see. 

Then access control is another arena and a lot of my colleagues 
here have talked about access control, getting in and out of places 
where one belongs to or one should not belong to. We have been 
active in that for the Department of Defense. 
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And, of course, the Superbowl has again gotten a lot of attention 
but that is a tested concept, again that it is possible, although we 
only identified 19 people but it is enough to save a lot of lives. 

In the state of Illinois, it is probably the biggest database we 
have. It has about 8.5 million images in the database. Every night 
about 15,000 driver’s license applications go into this database and 
it is searched to see if there is any redundancy or duplicates or 
false identifications. We currently have learned that the U.S. Mar- 
shal has used the Illinois system to confirm information that one 
of the 15 most wanted fugitives — using the facial recognition, they 
were able to find Mr. Escabedo’s driver’s license. From that, they 
arrested him in Mexico. I think he was a drug trafficker or some- 
thing like that. 

So with that, there is a lot to say about technologies but I urge 
the Senate to work with industry, to also work with the agencies 
to make it work for all of us. There is always the barriers to get 
into agencies, to get them to comply, to work with us. Academia, 
industry, government could work together and we have proved this 
over and over again. 

We do have another demo here. I am taking a very big chance 
here. This is a live demo. As you can see the screen, on the right 
side it is pure white. This is going to make Dr. Atick very panicked 
now. He is going to say, “Make sure it works, Joanna.” 

The live screen is where you see the image being captured right 
now. Carl is not in the database so we will not do anything with 
him but we did enroll one of your interns. I just wanted to show 
it to you. I knew nothing about your intern. Ally has been so good. 

Chairperson Feinstein. Ally,, what is your problem? 

Ms. Lau. So with that, I think I will leave it to the panel to an- 
swer questions. 

[The prepared statement of Ms. Lau follows:] 

Statement of Joanna Lau, Founder, Lau Technologies and Viisage 

Technology 

MADAME CHAIRWOMAN AND MEMBERS OF THE COMMITTEE, I want to 
thank you for the opportunity to testify on the important issue of how biometric 
technology, and specifically facial recognition technology can be used to prevent per- 
sons who wish to carry out acts of terrorism from entering the United States. 

As the founder and CEO of Lau Technologies I have devoted the last decade to 
the use of technology to ensure National Defense. This has led us to create our affil- 
iate, VIISAGE Technology to advance the use of facial recognition technolo^; a 
technology that I believe has the potential to fill an important role in this Nation’s 
current border security strategy. 

Almost all Americans believe that September 11, 2001 has shown that our borders 
are not as secure as we once thought that they were. However, it is only by review- 
ing and changing the current border security measures, as you are doing Madame 
Chairwoman, that we will be able to move forward and stay abreast with the 
threats that our Nation now faces. We must admit that there is no single answer, 
or “silver bullet” to solving our border security issues. Those of us in the private 
sector must be careful about over-promising or exaggerating “ready made solutions.” 
Clearly, we have tools that can help, one of which I will explain and demonstrate 
today. Our fellow citizens are demanding better technology and better law enforce- 
ment and I am pleased that my company is in a position to contribute. Let me tell 
you about facial recognition technology. 

Background on Facial Recognition Technology 

Almost a decade ago, researchers at the Massachusetts Institute of Technology 
(MIT) pioneered a facial recognition method known as “Eigenfaces”. Using this tech- 
nique, any facial image taken from still photographs, live or recorded video or com- 
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posite sketches, can be enrolled into the “Eigenface” system, which then reduces an 
individual’s face characteristics to 128 coefficients. Once enrolled, and using our al- 
gorithm, these images can be compared for possible matches. 

Lau Technologies acquired the rights to the MIT technology in 1994. Since that 
time we have spent millions of dollars and over 100 person-years to build on the 
original Eiganface algorithm. Today we have 25 patents in place or pending and 
each face that is compared using our system is subjected to several different algo- 
rithms. 

From an operational perspective, this software allows law enforcement to compare 
any face against a digital “mug-shot book” of images in real time to determine if 
there are possible matches. In the past, it would have taken an indidual hours to 
manually make this type of comparision with even a few thousand images — In the 
State of Illinois, we are currenly matching all new driver license applications 
against a database of 8.4 million existing drivers licenses, to identify fraud and du- 
plicates. Once a search is completed and a gallery is displayed, it is then up to the 
operator to review the possible matches and determine how to proceed. In this way, 
facial recogntion technology acts as a powerful force multiplier for investigators. 

To date, the technology has been used successfully by Federal, State and local 
government and the private sector for close to 5 years. Let me give you several ex- 
amples: 

• Pinellas County, Florid — This year with funding provided by Congress, 
the Pinellas County, FL Sheriffs Office began implementing facial recogni- 
tion to assist with jail operations and criminal investigations. 

• Casino Surveillance — Our technology is currently being used in over 100 
casinos worldwide. These establishments have enhanced their existing cam- 
eras with our technology to allow security officers to compare visitors 
against a database of close to 10,000 known cheats. Since then, the system 
has identified hundreds of unwanted individuals. 

• Access Control — today, the United States Army, Navy, Air Force and the 
Federal Aviation Administration use the technology for access control. 

• NFL Super Bowl — In cooperation with Federal, State and local law en- 
forcement, our company provided facial recognition technology at last year’s 
Super Bowl in Tampa, FL. Over 60,000 faces were scanned as they entered 
the stadium and their pictures were compared to a database that included 
terrorists, fugitives as well as known scalpers and pickpockets. While no 
one was arrested, 19 probable matches were made using the software. After 
each comparison that did not result in a match, the individuals image was 
immediately destroyed. 

• State of Illinois — Perhaps one of the most successful applications is the 
8.4 million drivers license images that are being scanned everyday for du- 
plicates and fraud, which I described earlier. This is by far the largest facial 
recognition database in the world. 

We recently learned that the U.S. Marshals used the Illinois system to con- 
firm information about one of their 15 Most Wanted Fugitives. Using only 
facial recognition, the Marshals compared a booking photograph of Daniel 
Escobedo to the DMV database. Within seconds, Mr. Escabedo’s driver’s li- 
cense came up first in a database of over 8 million images. The driver’s li- 
cense confirmed information that the Marshals had recently discovered 
using more traditional investigative techniques, that helped led to Mr. 
Escabido’s arrest. 

Since September 11th, we have obviously focused on how we can help ensure the 
security of our borders. We are working with various Federal Agencies to determine 
how to best utilize this technology and I wanted to bring to your attention a few 
applications that we feel could be particularly useful. 

Visa Issuance 

As you are well aware, last month Ambassador Mary Ryan indicated in testimony 
before this very Subcommittee that she would like to expand the use of facial rec- 
ognition technology with the Visa program. We believe an immediate use of facial 
recognition technology would be the full enrollment and comparison of the State De- 
partment’s visa database. With an estimated 10 million images already in the data- 
base, facial recognition is the only biometric that can compare every individual in 
this database against every other individual to look for multiple visas under as- 
sumed names. In addition, we could immediately run all 10 million images against 
the FBI and Intelligence community’s database of wanted terrorists. Most important 
to the on-going War on Terrorism, we have the capability to carry out this entire 
process in less than 90 days. 
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Going forward, as new visas are issued around the world there will continue to 
be a need to run these images against the faces of wanted terrorists. In almost 
every case, the only biometric information that we have about these terrorists is a 
picture. We would propose that as part of the application process, in addition to the 
security checks already undertaken, every individual’s picture would be compared 
to the watch-list before a visa is issued. 

Port of Entry Screening 

After a visa has been issued, we see a further use of facial recognition technology 
as a method of screening passengers at the Point of Entry. The use of biometric 
technology for airport security was recently endorsed in the Department of Trans- 
portation’s Airport Security report. We currently have deployed this surveillance 
technology at the International airport in Fresno, California and we are in talks 
with over a dozen additional airports throughout the United States. 

In these airports, cameras will be used to quickly capture images of passengers 
and compare them against the terrorist watch-list. If a match is not made, the pas- 
senger’s image is immediately destroyed. In the event that a possible match is 
made, the passenger is further investigated. 

Summary 

As Congress undertakes the vitally important task of securing our borders, it is 
clear that biometric technology can play a role. Specifically, if a face is available, 
and time is limited, facial recognition technology is a valuable tool to further ensure 
identification and security. 

With that, I am available to answer any questions you might have and would be 
happy to demonstrate for you how the technology works. 
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Security Applications foe Facial Recognition Technology 
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Chairperson Feinstein. Thank you very much. Thank you. I ap- 
preciate all of your testimony. It is a dazzling array of technology. 

Senator Kyi, why do you not begin this round? 

Senator Kyl. Thank you very much. 

All of you have been very, very helpful to us and we can see, I 
am sure, the advantage of each of these systems in different appli- 
cations. 

One question I have, and this applies to a couple of you but let 
me start with Mr. Haddock and I think it also applies to Miss 
Lyons. Where you have a card — in fact, let me just take this with 
the INS because INS uses your card now, as I understand it. Is 
that correct? 



64 


Mr. Haddock. That is correct, yes. 

Senator Kyl. How do you verify that the individual in possession 
of the card is, in fact, the individual whose data is on the card 
when that person conies through? 

Mr. Haddock. At the moment the INS does not do that. The 
data is on the card that they could do that hut they never imple- 
mented the readers on the border to do it. 

Senator Kyl. What would that take? 

Mr. Haddock. It would take — I have a reader in my briefcase 
there, a small unit like a CD-ROM drive that could be put on the 
existing PCs at the border, in any airport. Anywhere the INS has 
an inspector, they could put this unit on there and it can read the 
card in a matter of a few seconds. 

In the case of the INS card, they put the FBI-quality fingerprint 
image on it. They intended to select a minutia file to pull from that 
image to compare against, which can still be done on the existing 
cards. 

Chairperson Feinstein. What is a minutia file? 

Mr. Haddock. It is the mathematical representation of the pic- 
ture that actually these technologies match against. They do not 
match against the entire picture. They pull key points out and 
make a much smaller file called a minutia file and that is what 
electronically is matched. 

So in the case of the INS file, because these minutia templates, 
as they are called, are proprietary to the vendors, they did not 
want to select any given vendor’s technology at the offset of this 
program so they took the whole image with the idea that whenever 
they wished, they could pull from that image the minutia they 
needed and it could even be done dynamically even today. 

Senator Kyl. But it is fine to have the fingerprint on the card. 
It is a tamper-proof card but it is not a theft-proof card. So I get 
somebody else’s card; I am driving in my car through the port of 
entry. I show them the card, it is too quick for them to really look 
at the photo very well and they say okay. 

In order to verify that it is, in fact, the person to whom the card 
was issued, they would have to have the reader there, as well. 

Mr. Haddock. Absolutely. 

Senator Kyl. It would take a couple of seconds for that reader? 

Mr. Haddock. It typically takes about four seconds. When we 
have shown the INS here is the method to implement it, we show 
them about a four-second time. 

Senator Kyl. And how much would that cost for the ports of 
entry? 

Mr. Haddock. Today’s reader prices, about $2,000 per drive. 
This is in the quantities — 

Senator Kyl. $2,000 per machine? 

Mr. Haddock. Per machine, and that is about the only cost be- 
cause the rest, you just connect it to the PC. 

Senator Kyl. And how many machines are there supposed to be? 

Mr. Haddock. The maximum points would be 3,000. To equip 
the INS all the way around the country, every back office, front of- 
fice, would take about 3,000. You could hit obviously the key high- 
volume points with a lot less. I think probably 85 percent of the 



65 


entries come through a few hundred ports so it could he a small 
amount of money. 

Senator Kyl. So we need to get at that. 

Mr. Haddock. I would think so. We have been trying to deliver 
that message for a number of years. 

Senator Kyl. I just now got it. Because our time is very short, 
and we will follow up on that, by the way — where, for example, Mr. 
Willis, and this applies to Mr. Atick, I think, and others, as well, 
where you have the facial recognition or the hand you would have 
to still get the hand of the terrorist or whoever you are seeking to 
identify into the system somehow the first time, right? 

Mr. Willis. Right. All of our technologies require enrollment so 
you know who it is, to be able to compare it with. 

Senator Kyl. Right. Now contrast that with a photograph. And 
I guess this is a question to you, Mr. Atick. Do I understand what 
you were saying is that we have photographs of a lot of these ter- 
rorists? They are not necessarily great quality. If you could take 
the photograph with your own machine what would the percentage 
be of identification? 

Mr. Atick. The studies that were done in England regarding the 
effectiveness of facial recognition shows you that it is as effective 
as the best fingerprint technology if you could do the enrollment 
yourself using the controls that the system requires. But the point 
that I made in my testimony is that even with the FBI’s database 
that is just taken in the field from surveillance cameras and covert 
operations, we can still give you a value, that 60 to 90 percent of 
these terrorists will be intercepted. 

Senator Kyl. Right. Thank you. 

Chairperson Feinstein. Sixty to — 

Mr. Atick. Sixty to 90 percent, according to some recent studies 
that were done over the last two months. 

Senator Kyl. Just one other thing with regard to the hand. You 
said that the facial does not change over the aging process? 

Mr. Atick. The geometry. 

Senator Kyl. The aging process or through attempts at modi- 
fying the visual appearance. The hand changes over time. It can 
get very arthritic, for example. I happen to know that. And it looks 
a whole lot different at age 60 than it did at age 20. 

Mr. Huddart. If I can answer that? 

Senator Kyl. Yes, please. 

Mr. Huddart. Our template is adaptive so that every time you 
use the device it is looking for small changes that might occur, for 
example, in pregnant women whose hands tend to swell or over a 
longer period of time, the arthritic condition you mentioned. So the 
template adapts every time you use the device. We are looking for 
small changes and it will adapt for that. 

Senator Kyl. Okay. Rather than take the whole time here let me 
turn it back to you. Senator Feinstein. 

Chairperson Feinstein. Just very quickly, what is clear to me is 
that you are going to have to have a combination of technologies 
to really do it right. 

Secondly, the other problem is it looks like there is going to be 
a kind of — I don’t want to use the word hodge-podge but a lot of 
different technologies. Everybody is competing in this field. How do 
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we get the standards that develop the combinations that can be the 
most widely used with an eventual aim of having sort of the world- 
wide database with other countries entering into it? Anybody have 
any thoughts? 

Ms. Lau. I would comment that if you were to do today, for ex- 
ample, if you were to do just one or two or six airports, it is not 
going to solve the problem. 

Chairperson Feinstein. Right. 

Ms. Lau. You have to deploy it universally to really solve the 
problem. We are really in this war to fight terrorists. I think our 
allies will have to work with us. Individuals were asked, the two 
officials here, regarding sharing databases with Interpol. I do not 
think this is acceptable. From a citizen’s standpoint I think that if 
we are in this together, why could not our policy be such that we 
could share the database? That is one thing. 

True, there are a lot of technologies in place but not one single 
technology is going to provide your silver bullet. And the other 
thing is that every application and environment is very different 
and we rely on some of the experts that you have working in your 
government to work with industry. We are here to offer our exper- 
tise and help but we are not taking over their job. We have to work 
with them. 

Chairperson Feinstein. See, one of my concerns is whether we 
do have the expertise that is necessary. I think in a way, the INS 
example is classic and my experience with government has been, 
whether it is local government or now national government, there 
really is not the level of expertise that exists in the private sector, 
for obvious reasons. You know, we do not pay our people as well 
as the private sector does. Most of the hottest people go into the 
private sector. 

So absent this kind of consortium — we get very informal in these 
Subcommittees meetings. Senator Kyi — absent the ability to de- 
velop the standard and have the private-public partnership that is 
effective, I am not sure we will ever get at it. I am frankly appalled 
that INS would do a system whereby you have one half of the sys- 
tem and all these people have their cards and the other half is not 
in place. 

Mr. Haddock. To give the INS some credit, the card brought 
with it anti-counterfeiting features which stopped their main con- 
cern, which was counterfeiting on the street corner. The previous 
paper pink cards that were in issue were widely counterfeited. 
They needed to stop that immediately. By implementing the optical 
card, putting the etched image of the person on it, they effectively 
stopped that immediately. 

Chairperson Feinstein. Are you saying that the counterfeit busi- 
ness is out of business? Because I do not believe it is. 

Mr. Haddock. The previous card was a laminated pink piece of 
paper which anybody could make. The problem is they left them 
out there. They are still there. They are still valid for another six 
years, this previous generation, very easy to defraud cards. I asked 
the INS two weeks ago, “Can’t you do something about that?” and 
they said they cannot do it; Congress has to do it. Somebody has 
to tell them to recall these cards. 
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The Department of State did. For the border-crossing cards with 
Mexico, they stopped those. They stopped them on September 30. 
They no longer accept the paper previous generation cards. But the 
INS still takes the old generation, the pink cards, and so forth, and 
no one is doing anything about that. No one even talks about it. 

Senator Kyl. If I could just add to that, I think it is because they 
have not completed the issuance of the tamper-proof cards yet. 

Mr. Haddock. But the cards have a 10-year life so the pink ones 
are just slowly trickling in, so it will take another five years before 
you really have a tamper-proof card, unless someone says to do it 
today. 

Ms. Lyons. Excuse me. If I might add? 

Chairperson Feinstein. Go right ahead. 

Ms. Lyons. For what it is worth. 

I think the point that Mr. Haddock made in terms of it is a com- 
bination of biometrics that might be most appropriate — the point 
that you made at the beginning of the hearing in terms of a consor- 
tium is necessary, I absolutely think it is. We can create the exper- 
tise that we need to make the decisions. Even this panel, experts 
that we are, we have a blind spot as it relates to the other tech- 
nologies. 

So I do think that it is a consortium that needs to come together 
to make those decisions. To balance, if you are talking widespread, 
you know, you probably want a technology that has been honed, is 
reliable, and is inexpensive. In more critical areas, facial may be 
more appropriate in some areas. So I think together we have to 
conclude those decisions. 

Mr. Haddock, his view of the reader cost, these readers today, 
when plugged into an existing computer system, run around 20 
bucks. That is how the technology has gone down in price relative 
to some of this technology. It has been around for a while and price 
has now come way down and these door devices are less than 
$1,000 today. 

Mr. Huddart. If I can comment, too, on that question? 

Chairperson Eeinstein. Yes. 

Mr. Huddart. There are several pockets of government agencies 
that already have significant experience with biometrics — Sandia 
National Labs, for example. The FAA have done a lot of work, also. 
So I think if we could draw from that experience that have used 
a lot of the products represented here, the industry association, 
which myself and Dr. Atick are on the board. The International 
Biometrics Industry Association has proposed the national biomet- 
ric security project, which would take those best practices and in 
an unbiased fashion make recommendations for applications and 
further testing. 

But if I could also say that while that is all important to do, the 
fact remains that, for example, San Erancisco airport is safer today 
because it has already done something and my concern is that we 
spend two years developing standards and we are not any more se- 
cure than we are today. There are proven systems represented here 
that can address those concerns. 

Chairperson Eeinstein. I must tell you when I was mayor I told 
the director of the airports that if there is ever a bomb out of San 
Erancisco, do not show up the next day because you do not have 
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a job. And at that time there were even bogus bomb dogs, so they 
got the message and really went to work and, I think, produced. 

But what we have here, you are all rugged individualists. You 
are all obviously extraordinarily bright. Could you put together to 
Senator Kyi and myself a kind of, if you would, quick compendium 
of what we would have to do to have the kind of system standard- 
ization that is necessary? Does that make sense? Because the re- 
sult of this hearing, for me, is we have some wonderful things out 
there but it is such a dazzling array, it is very hard for lay people 
to know what works better in what kind of situation. And because 
you are all individualists, you all have different companies and it 
would be very useful if you could come together and say we think 
these are the imperatives that you need to have to move forward. 

Mr. Haddock. If I could answer that briefly, there is an inter- 
national standards working group on international travel docu- 
ments, WG-3, and in that there is a machine-readable data seg- 
ment which allows each type of data element that is encoded on a 
card to be read by any other reader so that people could know 
whether it had a hand or an eye or an iris or whatever, by reading 
it. 

So you could have multiple biometrics, the cards could be dif- 
ferent, they could be used for different applications, but there is a 
standard to help sort that out. So there is some sense to all this. 

Mr. Willis. Madam Chairman, there is also some cooperation 
amongst the panel here already. We have been working together to 
look at — 

Chairperson Feinstein. Would you excuse me just for a minute? 
I have a meeting with the prime minister of Mongolia. He has just 
arrived. So I am going to have to leave but I am going to turn this 
hearing — and thank you very much — and turn it over to the very 
able hands of Senator Kyi, if I might. 

Senator Kyl. Thank you. I am already late, as well. 

Please finish and then — 

Mr. Willis. What I want to say is I think we are as sensitive 
as an industry as you are to the solutions and we have been infor- 
mally having discussions on making a tool set. When you are try- 
ing to make a solution you need a tool or a set of tools based on 
what you are trying to solve and I think we are starting that infor- 
mally and I think this would certainly help expedite that. 

Senator Kyl. One final thing. I should announce that the record 
will be open until November 21 at 5 p.m., which means that each 
of you who would like to submit any additional testimony or infor- 
mation may do so. I will try to get my questions, if there are any 
more, to you well in advance of that. 

I just did have one final question. Are any of you suggesting that 
any of the data that goes into these cards be data on an Internet 
system or do each of you agree that these need to be discrete sys- 
tems separate from the Internet? 

Mr. Atick. They need to be networked at the end of the day. 

Senator Kyl. They need to be networked? 

Mr. Atick. They need to be networked if they are to give you the 
power of controlling access and the power of scalability. But obvi- 
ously that produces a whole slew of issues associated with the pri- 
vacy and security of that data. 
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Senator Kyl. It produces a whole slew of issues with me, so that 
is something we have to talk about. 

Mr. Atick. Absolutely. 

Mr. Haddock. We think it should be completely decentralized, 
off-line, secure on the card. 

Senator Kyl. Yes, that is my inclination. So could I ask all of you 
to maybe just submit us a little memo reflecting your thoughts on 
that particular question? I know there are pros and cons of both. 
I have my prejudices but would appreciate being edified by the 
opinions of each of you. 

Thank you again. This was a very, very helpful hearing. We ap- 
preciate all of you being here. The hearing is adjourned. 

[Whereupon, at 12:04 p.m., the Subcommittee was adjourned.] 

[Submissions for the record follow.] 

[Additional material is being retained in the Committee files.] 

SUBMISSIONS FOR THE RECORD 
Senator Dianne Feinstein and Senator Jon Kyl 

“Visa Entry Reform Act of 2001” 

STRENGTHENING COUNTERTERRORISM EFFORTS AT THE PORTS OF ENTRY 

The legislation to strengthen counterterrorism efforts at the ports of entry will do 
the following: 

Section 1: Short title. “Visa Entry Reform Act of 2001.” 

Section 2: Establishment of a Comprehensive “Lookout” Database 

Mandate the creation of a comprehensive, integrated “lookout” database of visa 
holders and other nonU.S. citizens who enter the U.S. Require all immigration, in- 
telligence, and law enforcement agencies to contribute relevant information, and the 
require the database to be accessible at all ports of entry. Centralized data system 
must be flexible and scalable to meet ongoing immigration and law enforcement 
needs in the future. 

Direct the Homeland Defense Director to oversee the development of the database 
in conjunction with the Department of Justice, the INS, Department of State, De- 
partment of Transportation, CIA, and private industry, to identify and track terror- 
ists and suspected terrorists. 

Require the database to be designed to connect law enforcement, intelligence, INS 
and State Department information in one centralized data system so that informa- 
tion may be readily shared among agencies. 

Require the Director to submit report to Congress within 3 months of enactment 
regarding the type of data contained in centralized database; levels of access to such 
data; methods to secure such data from abuse and/or unlawful access; and infra- 
structure needs to implement system through national and overseas offices of rel- 
evant Federal agencies. 

Require the INS to upgrade its electronic data system to include biometric data 
(i.e., fingerprints, photographs, facial recognition technology) on all foreign nationals 
applying to enter the U.S. within 6 months. 

Require the INS to place into a centralized data base all foreign nationals who 
have violated the terms of their visas (e.g., remained in U.S. after visa expired, com- 
mitted a crime, performed unauthorized work or took unauthorized classes). 

Not later than 30 days of enactment, require the Secretary of State to establish 
within each U.S. embassy a terrorist lookout committee. 

Section 3: Implementation of a New Biometric “SmartVisa” 

Require the INS and State Department to establish a biometric “smart visa” to 
enable the INS to track foreign nationals upon entering and exiting the U.S. 

Authorize funding for biometric card readers and scanners to be deployed at all 
U.S. land, air and sea ports of entry to implement process. 
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Section 4: Reform of the Visa Waiver Program 

Mandate that within 1 year, countries wishing to participate in the visa waiver 
program first provide a tamper-resistant, machine-readable passports. 

Within 2 years, all countries must also include biometric data on those passports, 
which conforms to U.S. standards. 

The Attorney General and the Secretary of State shall jointly determine standard 
biometric identifier(s) that would be required on all U.S. and foreign passports and 
visas. 

Mandate that the INS check all Visa Waiver passport numbers, names, and, 
where available, biometric data with the new, centralized database. 

Require participating countries to report stolen passports to the State Depart- 
ment. 

Section 5: Pre-Screening of Foreign Nationals Prior to Arrival in the U.S. 

Repeal Sec. 286(g) of the Immigration and Nationality Act, which requires that 
all in-transit flights to the U.S. be cleared by the INS within 45 minutes. 

Require all nonimmigrants to submit fingerprints and/or other designated biomet- 
ric data to the State Department when applying for a visa. 

Require the State Department to electronically transmit versions of its visa files 
to the centralized lookout database, so that information on arriving aliens is avail- 
able to the INS prior to the time of inspection. 

Access to database shall be limited to authorized immigration and law enforce- 
ment personnel. Require the Attorney General and Secretary of State to develop 
regulations specifying the limitations of use. 

New and increased penalties for the misuse or theft of information contained in 
database. 

Section 6: Passenger Manifest Information 

Require all airlines, cruise lines, vessels and cross-border bus lines submit pas- 
senger and crew manifests to the central database prior to departure. 

Require the INS to check passenger information against the lookout list. 

Section 7: Requirements for Federal Documents 

Mandate that all U.S. Federal identification documents be fraud- and tamper-re- 
sistant. 

Mandate that all immigration related documents, including work authorization 
and visas, be fraud- and tamper-resistant, contain biometric data, and, if applicable, 
include the visa’s expiration date. 

Where minimum Federal standards apply to state commercial licenses, those 
standards are amended to require that such documents and licenses: 
provide positive identification of the holder; 
are tamper- and fraud-resistant; and 
contains biometric data. 

Any person conferring a personal identity document on an unauthorized basis 
would be in violation of Federal law. 

Section 8: Bar on Entry of Foreign Students from Terrorist-sponsoring countries 

Prohibit the State Department from issuing student visas to individuals from 
countries included on the Department’s list of terrorist-sponsoring states. 

Permit the Secretary of State to waive the bar on student visa issuance for a for- 
eign student if he performs an extensive background check and certifies that the 
student does not pose a threat to the national security. 

Section 9: Reform of the Foreign Student Visa Process 

Require any additional costs to fully implement and expand the tracking program 
established under Sec. 641(a) of the Illegal Immigration Reform and Immigrant Re- 
form Act. [8 U.S.C. 1372a] — beyond that covered by Congressional appropriations — 
to be covered by application fees paid by foreign students. 

Prohibit educational institutions from providing INS Form 1-20 to foreign nation- 
als appl3dng for foreign student visas. 

Require educational institutions to submit the INS Form 1-20 directly to the De- 
partment of State. The form must provide: 

a. the identity of the student; 

b. the student’s address in the country of origin; 

c. names and addresses of parents and siblings; 

d. contacts in country of residence, including organization affiliations, or 
close associates who could verify information about the student; 

list of prior work experience; 
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f. academic course of study at institution; 

g. period of enrollment at the institution; and 

h. the consulate at which the foreign national will apply for a student visa. 

Require the State Department to notify the school at which the alien intends to 

enroll upon the issuance of a foreign student visa. 

Require all such data to he entered into the centralized database established 
under Sec. 1. 

Require the INS to conduct a background check prior to the issuance of a foreign 
student visa, which would include, but not be limited to: 

a. a name check, and biometric data check where available, on the INS 
lookout system, the INS IDENT system, the Interagency Border Inspection 
System; and the FBI’s lAFIS system; and 

b. a check to ensure that the alien is not subject to a bar to reentry as a 
result of a previous violation of immigration law. 

Require all educational institutions to submit data to the INS within 30 days of 
the foreign student’s enrollment, including: 

a. the student’s full name; 

b. address in country of origin; 

c. actual address in the U.S.; 

e. date of commencement of studies; 

f. degree program and list of courses; 

g. status of student (e.g., full-time or part-time); and 

h. date of the last day of classes. 

Require schools to provide the INS status report on a quarterly basis to: 

a. certify that the student has enrolled and registered; and 

b. notify authorities of any disciplinary or law enforcement action involving 
the foreign student. 

Require all schools to immediately report to the INS within 30 days: 

a. the failure of a student to register, enroll or appear at designated institu- 
tion; 

b. the foreign student’s withdrawal from the institution; and 

c. any failure to comply with the terms of his or her visa. 

Require the INS to notify the State Department and immigration authorities 
when foreign students fail to meet the requirements of their visas. Require the INS 
to enter relevant data regarding the students’ immigration violations in the central 
database. 

Prohibit the automatic extension of a foreign student visa. Foreign nationals must 
apply for an extension of their student visas and submit to second background 
check. Students who have violated the terms of their visa while in the U.S. would 
not be eligible for an extension and would be immediately deportable. 

Modifies current definition of an “approved institution of higher definition” under 
the current law to include vocational, trade, flight training and language training 
schools. This effectively expands the list of schools and type of foreign students the 
INS is required to track. 

Section 10. Requirements Relating to the Admission of Nonimmigrant Aliens 

Require all nonimmigrant visa applicants to submit to fingerprinting and/or other 
biometric requirements to enable the INS and State Department to perform exten- 
sive background checks on individuals before they enter the U.S. 

Require the Secretary of State to assign such additional number of consular offi- 
cers as may be necessary to achieve effective screening of visa applicants. Author- 
izes such sums as necessary. 

Require the INS to perform a background check before the State Department can 
issue a visa. Authorize such sums as necessary. 

Section 11. Additional Port of Entry PerSOnneL 

Authorize an increase of not less than 200 INS inspectors in each of the fiscal 
years 2002 through 2006. 

Authorize an increase in INS investigatory personnel for the purposes of identi- 
fying and locating visa violators, particularly those who pose a risk to national secu- 
rity. 

Authorize an increase of not less than 200 U.S. Customs inspectors in each of the 
fiscal years 2002 through 2006. 

Section 12. General Accounting Office Study. 

Requires a study on the feasibility of implementing a plan wherein non- 
immigrants are required to present to the Commissioner each year to provide cer- 
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tain status information. Requires GAO to report within 1 year on the findings of 
the study. 


Statement of Hon. Strom Thurmond, a U.S. Senator from the State of South 

Carolina 


Madam Chairwoman: 

I am pleased that this Committee is considering the use of biometric identifiers 
in the war against terrorism. Biometric identifiers, including fingerprints and photo- 
graphs, have national security implications because they would make the forgery of 
identification documents more difficult. Visas and immigrationrelated documents 
should contain these identifiers, which will make it harder for terrorists who enter 
the country to conceal their true identities. Biometric identifiers should also be 
added to a comprehensive database that would include information about all non- 
citizens entering the United States. These safety measures would assist immigra- 
tion officials in identifying terrorists who attempt to cross our borders. 

While I recognize that most aliens are law-abiding people who make valuable con- 
tributions to our society, it is apparent that there are some who wish to do us harm. 
The colleagues. 

The bill would require aliens to present a SmartVisa upon entry into or exit from 
the United States. This is a good start. However, I would like to extend the 
SmartVisa system beyond entry and exit purposes. We should require that aliens 
use the SmartVisa card when applying for jobs -and registering for courses. By 
swiping the SmartVisa, employers and educational institutions would be alerted to 
the expiration of a visa or the withdrawal from classes by an alien on a student 
visa. 

The use of biometric data and the careful monitoring of aliens is especially nec- 
essary in light of the large number of immigrant and nonimmigrant visas granted 
each year to people from terrorist-supporting countries. In Fiscal Year 2000, we 
issued more than 3,000 visas to aliens from Iraq and more than 5,000 to people from 
Sudan. Almost 16,000 visas were issued to aliens from Syria and more than 30,000 
were issued to people from Iran. We also annually admit individuals from terrorist- 
supporting states such as Libya, Cuba, and North Korea. Because of the large num- 
bers of people who obtain visas from states that support terrorism, it is critical to 
our National security that we monitor alien activity inside our borders. 

Beyond the use of SmartVisas, I believe that we should take further steps to pro- 
tect the American people. In light of the recent terrorist activity within our borders. 
Congress should consider the annual registration of aliens. Annual registration was 
required in the past but was discontinued in 1981. Currently, aliens are required 
to notify the Attorney General of changes in an address but are not required to up- 
date information on a yearly basis. 

The Federal Government has the power and the responsibility to verify that 
aliens are in the country for authorized reasons. At the least, annual registration 
should be required for nonimmigrants, most of whom will not become U.S. citizens. 
Annual registration of nonimmigrants would help the government to monitor the 
movements and activities of aliens who hold work and study visas. It is important 
to note that according to media reports, one of the hijackers of September 11 arrived 
in the United States on a student visa but did not attend classes. 

Madam Chairwoman, thank you for holding this hearing on a timely and impor- 
tant topic. The use of biometric data on a SmartVisa System and the development 
of a centralized database would be very beneficial to the fight against terrorism. If 
used in conjunction with annual registration, I believe that the Federal Government 
would have the tools necessary to ensure that terrorists do not take advantage of 
our open society to murder more Americans. In this fight against terrorism, it is 
essential that we use the newest technology feasible, and biometric data is a step 
in the right direction. The use of biometric data will assist immigration officials in 
determining whether an alien is a threat to the safety of Americans. We should not 
miss out on this opportunity to make our country safer and more secure. 
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RAND 

Arlington, VA 22202-5050 

November 14, 2001 


The Hon.Dianne Feinstein, Chairwoman 

Subcommittee on Technology, Terrorism and Government Information 

Senate Judiciary Committee 

224 Dirksen Senate Office Building 

Washington, D.C. 20510 

Dear Chairwoman Feinstein: 

Thank you for asking me to submit written testimony for your subcommittee’s 
hearing on “Biometric Identifiers and the Modern Face of Terror: New Technologies 
in the Global War on Terrorism.” I am honored by this consideration. As my written 
testimony, I am submitting Biometrics: Facing Up to Terrorism, RAND Issue Paper 
(IP-218) published this year. 

To help protect RAND’s legal responsibilities, please include the following infor- 
mation with the written testimony: “John D. Woodward, Jr. is a senior policy ana- 
lyst at RAND. He has testified on biometrics before the U.S. Congress and the Com- 
mission on Online Child Protection. RAND is a nonprofit institution that helps im- 
prove policy and decisionmaking through research and analysis. This testimony is 
based on a variety of sources, including research conducted at RAND. However, the 
opinions and conclusions expressed are those of the author and should not be inter- 
preted as representing those of RAND or any of the agencies or others sponsoring 
its research.” 

If you have any questions or require additional information, please contact me at 
(703) 413-1100, extension 5242. Thank you again for your invitation. 

Sincerely yours. 


o 


John D. Woodward, Jr., Esq. 



